a0ff88351288fd4fb1a903be6ad3a414aba14e888d4de4318ccb793b9b879511

Analysis

max time kernel
128s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe
Size 6.8MB
Sample260910-lecfzsan3s
SHA256 a0ff88351288fd4fb1a903be6ad3a414aba14e888d4de4318ccb793b9b879511
MD5 e61146f7c23ba878c42da3cb1fae7723
SHA1 1d3556fc51102203444f5454146d24e16c5c97bc
SHA512 0755c1aec5f2246976aae4880b5768439e9c21e37eab86f3b03de173de5179707eca155aba5e0522fc795982c0a0e90b48ec34ba1c54985981094cef6582b660
SSDEEP 196608:25aFN+orsz0Et+7OXyC8J1mEcN6RTckASm79uGu:25aX0N4Adg1mEo6GkAQR
TLSH
T1EA66333061A9A8B7C0530A759588FBBC63F1F8B3078558CB47015F074BAAADE8A7D47D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables built or packed with PS2EXE 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c549-212.dat	INDICATOR_EXE_Packed_PS2EXE
behavioral2/memory/4864-220-0x00000000006E0000-0x0000000000704000-memory.dmp	INDICATOR_EXE_Packed_PS2EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1304	powershell.exe
4456	powershell.exe
5612	powershell.exe
4812	powershell.exe
1520	powershell.exe
4512	powershell.exe
3192	powershell.exe
2812	powershell.exe
2796	powershell.exe
4576	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	Setup.exe

Power Settings 1 TTPs 12 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1676	powercfg.exe
2832	powercfg.exe
5608	powercfg.exe
5460	powercfg.exe
936	powercfg.exe
3884	powercfg.exe
4432	powercfg.exe
748	powercfg.exe
5076	powercfg.exe
240	powercfg.exe
6140	powercfg.exe
3140	powercfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4876	schtasks.exe
4364	schtasks.exe
2424	schtasks.exe
4660	schtasks.exe
4988	schtasks.exe
5700	schtasks.exe
1624	schtasks.exe
4632	schtasks.exe
4944	schtasks.exe
3892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
3192	powershell.exe
3192	powershell.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
2812	powershell.exe
2812	powershell.exe
2812	powershell.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4864	Setup.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4864	Setup.exe
4864	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	Setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	Setup.exe
Token: SeShutdownPrivilege	6140	powercfg.exe
Token: SeCreatePagefilePrivilege	6140	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4864	Setup.exe
Token: SeSecurityPrivilege	4864	Setup.exe
Token: SeTakeOwnershipPrivilege	4864	Setup.exe
Token: SeLoadDriverPrivilege	4864	Setup.exe
Token: SeSystemProfilePrivilege	4864	Setup.exe
Token: SeSystemtimePrivilege	4864	Setup.exe
Token: SeProfSingleProcessPrivilege	4864	Setup.exe
Token: SeIncBasePriorityPrivilege	4864	Setup.exe
Token: SeCreatePagefilePrivilege	4864	Setup.exe
Token: SeBackupPrivilege	4864	Setup.exe
Token: SeRestorePrivilege	4864	Setup.exe
Token: SeShutdownPrivilege	4864	Setup.exe
Token: SeDebugPrivilege	4864	Setup.exe
Token: SeSystemEnvironmentPrivilege	4864	Setup.exe
Token: SeRemoteShutdownPrivilege	4864	Setup.exe
Token: SeUndockPrivilege	4864	Setup.exe
Token: SeManageVolumePrivilege	4864	Setup.exe
Token: 33	4864	Setup.exe
Token: 34	4864	Setup.exe
Token: 35	4864	Setup.exe
Token: 36	4864	Setup.exe
Token: SeShutdownPrivilege	3140	powercfg.exe
Token: SeCreatePagefilePrivilege	3140	powercfg.exe
Token: SeShutdownPrivilege	3884	powercfg.exe
Token: SeCreatePagefilePrivilege	3884	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4864	Setup.exe
Token: SeSecurityPrivilege	4864	Setup.exe
Token: SeTakeOwnershipPrivilege	4864	Setup.exe
Token: SeLoadDriverPrivilege	4864	Setup.exe
Token: SeSystemProfilePrivilege	4864	Setup.exe
Token: SeSystemtimePrivilege	4864	Setup.exe
Token: SeProfSingleProcessPrivilege	4864	Setup.exe
Token: SeIncBasePriorityPrivilege	4864	Setup.exe
Token: SeCreatePagefilePrivilege	4864	Setup.exe
Token: SeBackupPrivilege	4864	Setup.exe
Token: SeRestorePrivilege	4864	Setup.exe
Token: SeShutdownPrivilege	4864	Setup.exe
Token: SeDebugPrivilege	4864	Setup.exe
Token: SeSystemEnvironmentPrivilege	4864	Setup.exe
Token: SeRemoteShutdownPrivilege	4864	Setup.exe
Token: SeUndockPrivilege	4864	Setup.exe
Token: SeManageVolumePrivilege	4864	Setup.exe
Token: 33	4864	Setup.exe
Token: 34	4864	Setup.exe
Token: 35	4864	Setup.exe
Token: 36	4864	Setup.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	Setup.exe
Token: SeSecurityPrivilege	4864	Setup.exe
Token: SeTakeOwnershipPrivilege	4864	Setup.exe
Token: SeLoadDriverPrivilege	4864	Setup.exe
Token: SeSystemProfilePrivilege	4864	Setup.exe
Token: SeSystemtimePrivilege	4864	Setup.exe
Token: SeProfSingleProcessPrivilege	4864	Setup.exe
Token: SeIncBasePriorityPrivilege	4864	Setup.exe
Token: SeCreatePagefilePrivilege	4864	Setup.exe
Token: SeBackupPrivilege	4864	Setup.exe
Token: SeRestorePrivilege	4864	Setup.exe
Token: SeShutdownPrivilege	4864	Setup.exe
Token: SeDebugPrivilege	4864	Setup.exe
Token: SeSystemEnvironmentPrivilege	4864	Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 4864	996	2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe	89
PID 4864 wrote to memory of 2972	4864	Setup.exe	90
PID 2972 wrote to memory of 4172	2972	csc.exe	92
PID 4864 wrote to memory of 5840	4864	Setup.exe	93
PID 5840 wrote to memory of 5760	5840	csc.exe	95
PID 4864 wrote to memory of 1288	4864	Setup.exe	96
PID 1288 wrote to memory of 4120	1288	csc.exe	98
PID 4864 wrote to memory of 3704	4864	Setup.exe	99
PID 3704 wrote to memory of 828	3704	csc.exe	101
PID 4864 wrote to memory of 4184	4864	Setup.exe	102
PID 4184 wrote to memory of 4940	4184	csc.exe	104
PID 4864 wrote to memory of 5636	4864	Setup.exe	105
PID 5636 wrote to memory of 5584	5636	csc.exe	107
PID 4864 wrote to memory of 4980	4864	Setup.exe	108
PID 4980 wrote to memory of 748	4980	csc.exe	110
PID 4864 wrote to memory of 5480	4864	Setup.exe	111
PID 5480 wrote to memory of 5672	5480	csc.exe	113
PID 4864 wrote to memory of 4460	4864	Setup.exe	114
PID 4460 wrote to memory of 4500	4460	csc.exe	116
PID 4864 wrote to memory of 2292	4864	Setup.exe	117
PID 4864 wrote to memory of 5740	4864	Setup.exe	119
PID 4864 wrote to memory of 2460	4864	Setup.exe	121
PID 4864 wrote to memory of 3316	4864	Setup.exe	123
PID 4864 wrote to memory of 3440	4864	Setup.exe	125
PID 3440 wrote to memory of 5180	3440	csc.exe	127
PID 4864 wrote to memory of 4076	4864	Setup.exe	128
PID 4864 wrote to memory of 1272	4864	Setup.exe	130
PID 4864 wrote to memory of 6140	4864	Setup.exe	134
PID 4864 wrote to memory of 4484	4864	Setup.exe	135
PID 4864 wrote to memory of 1088	4864	Setup.exe	137
PID 4864 wrote to memory of 3140	4864	Setup.exe	140
PID 4864 wrote to memory of 4624	4864	Setup.exe	141
PID 4864 wrote to memory of 2156	4864	Setup.exe	143
PID 4864 wrote to memory of 4596	4864	Setup.exe	145
PID 4864 wrote to memory of 5744	4864	Setup.exe	147
PID 4864 wrote to memory of 2564	4864	Setup.exe	149
PID 4864 wrote to memory of 3792	4864	Setup.exe	151
PID 4864 wrote to memory of 2800	4864	Setup.exe	153
PID 4864 wrote to memory of 2628	4864	Setup.exe	155
PID 4864 wrote to memory of 1624	4864	Setup.exe	157
PID 4864 wrote to memory of 3884	4864	Setup.exe	160
PID 4864 wrote to memory of 3180	4864	Setup.exe	162
PID 4864 wrote to memory of 5776	4864	Setup.exe	164
PID 4864 wrote to memory of 4920	4864	Setup.exe	166
PID 4864 wrote to memory of 1132	4864	Setup.exe	168
PID 4864 wrote to memory of 932	4864	Setup.exe	171
PID 4864 wrote to memory of 4356	4864	Setup.exe	174
PID 4864 wrote to memory of 1080	4864	Setup.exe	176
PID 4864 wrote to memory of 4068	4864	Setup.exe	178
PID 4864 wrote to memory of 5972	4864	Setup.exe	181
PID 4864 wrote to memory of 1264	4864	Setup.exe	183
PID 4864 wrote to memory of 788	4864	Setup.exe	185
PID 4864 wrote to memory of 2320	4864	Setup.exe	187
PID 4864 wrote to memory of 4884	4864	Setup.exe	189
PID 4864 wrote to memory of 3404	4864	Setup.exe	191
PID 4864 wrote to memory of 4632	4864	Setup.exe	193
PID 4864 wrote to memory of 1676	4864	Setup.exe	196
PID 4864 wrote to memory of 6116	4864	Setup.exe	198
PID 4864 wrote to memory of 1724	4864	Setup.exe	200
PID 4864 wrote to memory of 5056	4864	Setup.exe	202
PID 4864 wrote to memory of 1956	4864	Setup.exe	204
PID 4864 wrote to memory of 6032	4864	Setup.exe	206
PID 4864 wrote to memory of 5592	4864	Setup.exe	208
PID 4864 wrote to memory of 2356	4864	Setup.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_e61146f7c23ba878c42da3cb1fae7723_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wjy04ro2\wjy04ro2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50D5.tmp" "c:\Users\Admin\AppData\Local\Temp\wjy04ro2\CSC2781169771D34BD2BD93F9667F6F65C.TMP"
      4⤵
      PID:4172
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jhnmevvy\jhnmevvy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES525C.tmp" "c:\Users\Admin\AppData\Local\Temp\jhnmevvy\CSC44FDF6B640AC431998E57FE5AE8650C.TMP"
      4⤵
      PID:5760
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ts5zk4f5\ts5zk4f5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5327.tmp" "c:\Users\Admin\AppData\Local\Temp\ts5zk4f5\CSC109684514F3143A384F7B96DC7872146.TMP"
      4⤵
      PID:4120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2tes5o1l\2tes5o1l.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53E3.tmp" "c:\Users\Admin\AppData\Local\Temp\2tes5o1l\CSCFEA277C71224647906B40B62BD7E3D3.TMP"
      4⤵
      PID:828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ijw2yp3t\ijw2yp3t.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EC0.tmp" "c:\Users\Admin\AppData\Local\Temp\ijw2yp3t\CSC1EEF67B0C744379B72088A46DBEDD5.TMP"
      4⤵
      PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\evob4zrw\evob4zrw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5636
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F6C.tmp" "c:\Users\Admin\AppData\Local\Temp\evob4zrw\CSCA737E11614374F85B39C7D5725A6AF7F.TMP"
      4⤵
      PID:5584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kgxxmj5f\kgxxmj5f.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6008.tmp" "c:\Users\Admin\AppData\Local\Temp\kgxxmj5f\CSC857C8512A73A43D5ABDA94AC9C1D81B9.TMP"
      4⤵
      PID:748
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\caf43iz4\caf43iz4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60A4.tmp" "c:\Users\Admin\AppData\Local\Temp\caf43iz4\CSCD48677E039E1407894CDE173F7A35048.TMP"
      4⤵
      PID:5672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\my2tqgqx\my2tqgqx.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES616F.tmp" "c:\Users\Admin\AppData\Local\Temp\my2tqgqx\CSCA35CFFEC6CBD4CEEBAEC277A4E62A4.TMP"
      4⤵
      PID:4500
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2292
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5740
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2460
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ong43xgq\ong43xgq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7352.tmp" "c:\Users\Admin\AppData\Local\Temp\ong43xgq\CSC2587C4C692774CB99364FEF40D3B349.TMP"
      4⤵
      PID:5180
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4076
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:1272
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:4484
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:1088
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4624
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5744
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2564
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3792
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2800
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:2628
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1624
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:3180
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:5776
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4920
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:1132
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:932
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4356
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:1080
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:4068
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:5972
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:1264
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:788
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:1676
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:1724
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:1956
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:6032
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:5592
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:2356
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:5676
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:3628
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:2756
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2692
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:2192
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:2832
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:4692
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:1788
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:2204
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:5672
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4396
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:2924
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:5680
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2608
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:5172
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:4072
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:5640
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:4432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:5376
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3020
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:3380
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:2748
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:2564
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:4860
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:5444
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4164
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:748
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:1636
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2204
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2196
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4052
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:1684
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4708
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4688
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5172
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:788
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:252
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2300
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4216
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:5608
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:4884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5640
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3212
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:5512
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4996
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:2812
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2844
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:5744
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:2452
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4340
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4588
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:5460
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:2204
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:5304
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:1772
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2948
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:4232
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3728
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:5324
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4108
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:5740
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:4132
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2600
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:2560
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4216
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5700
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:5076
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:6140
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2908
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4396
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2204
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:4316
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:3220
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3296
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4068
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:3432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:240
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:792
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:5752
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:2452
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Interactive)"
    3⤵
    PID:5532
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "\SAMISH (Hidden)"
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /End /TN "\SAMISH (Hidden)"
    3⤵
    PID:5692
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:4836
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:5304
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Hidden)" /F
    3⤵
    PID:3168
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "\SAMISH (Interactive)" /F
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SAMISH (Hidden)" /XML "C:\Users\Admin\AppData\Roaming\SAMISH\SAMISH-HiddenTask.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4364
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /getactivescheme
    3⤵
    - Power Settings
    PID:936
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Hidden)"
    3⤵
    PID:5352
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Query /TN "SAMISH (Interactive)"
    3⤵
    PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:2964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2812

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:5896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:1488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:3360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5612

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:4160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2796

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:1676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4812

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:5624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wyljikbt\wyljikbt.cmdline"
  2⤵
  PID:1944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE40.tmp" "c:\Users\Admin\AppData\Local\Temp\wyljikbt\CSC9635B85AA9CA46418127C959AAE96A62.TMP"
    3⤵
    PID:4076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g1vke2tv\g1vke2tv.cmdline"
  2⤵
  PID:4596
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFB7.tmp" "c:\Users\Admin\AppData\Local\Temp\g1vke2tv\CSC296F45D9A28F4643A298863BC1F7FA1F.TMP"
    3⤵
    PID:5856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ixqur440\ixqur440.cmdline"
  2⤵
  PID:1088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC380.tmp" "c:\Users\Admin\AppData\Local\Temp\ixqur440\CSC953840839B424427828957B6431F2E2.TMP"
    3⤵
    PID:1072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qf4zmfyb\qf4zmfyb.cmdline"
  2⤵
  PID:5552
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC6DB.tmp" "c:\Users\Admin\AppData\Local\Temp\qf4zmfyb\CSCAC2BD6EF721B4A19A4F154746B6BFB3.TMP"
    3⤵
    PID:2748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wvxknkoi\wvxknkoi.cmdline"
  2⤵
  PID:2756
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8B0.tmp" "c:\Users\Admin\AppData\Local\Temp\wvxknkoi\CSC336503F56D584330831B5A394FCA8AAC.TMP"
    3⤵
    PID:4456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rgi2jyb3\rgi2jyb3.cmdline"
  2⤵
  PID:4844
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDA2.tmp" "c:\Users\Admin\AppData\Local\Temp\rgi2jyb3\CSCF84A523DA7EA4DC4A6ACE9929424322C.TMP"
    3⤵
    PID:4292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l25mcbza\l25mcbza.cmdline"
  2⤵
  PID:2516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF57.tmp" "c:\Users\Admin\AppData\Local\Temp\l25mcbza\CSCEBA0CE89AA6A4AB8B74A8B5BE86ADD1A.TMP"
    3⤵
    PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oxn0u3gj\oxn0u3gj.cmdline"
  2⤵
  PID:2324
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD216.tmp" "c:\Users\Admin\AppData\Local\Temp\oxn0u3gj\CSC805C1D56A07B4B848272AF2BD7B4F197.TMP"
    3⤵
    PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yfkrx1k4\yfkrx1k4.cmdline"
  2⤵
  PID:1432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD64D.tmp" "c:\Users\Admin\AppData\Local\Temp\yfkrx1k4\CSC39BF52D7A3A4465E817513A883D5F08A.TMP"
    3⤵
    PID:4836

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:3132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4512
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5odv350y\5odv350y.cmdline"
  2⤵
  PID:1140
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE59.tmp" "c:\Users\Admin\AppData\Local\Temp\5odv350y\CSCAB3569FFA31445808AD477CDFC103E1C.TMP"
    3⤵
    PID:3252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2lmgkm3o\2lmgkm3o.cmdline"
  2⤵
  PID:5556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0AB.tmp" "c:\Users\Admin\AppData\Local\Temp\2lmgkm3o\CSC9AE6F89113834E3B8038D7A7641AD93B.TMP"
    3⤵
    PID:1272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jch4rihl\jch4rihl.cmdline"
  2⤵
  PID:6120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF416.tmp" "c:\Users\Admin\AppData\Local\Temp\jch4rihl\CSC64CA898F2884DF49053C4C233A66A69.TMP"
    3⤵
    PID:5700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yxk5kpsu\yxk5kpsu.cmdline"
  2⤵
  PID:5084
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF6B5.tmp" "c:\Users\Admin\AppData\Local\Temp\yxk5kpsu\CSC730D45F929D4900A3F2D4F3C71B3BE.TMP"
    3⤵
    PID:3904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mc33gsi0\mc33gsi0.cmdline"
  2⤵
  PID:3020
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA01.tmp" "c:\Users\Admin\AppData\Local\Temp\mc33gsi0\CSCCDC4A8B2515540E0BB128A1B28A6178B.TMP"
    3⤵
    PID:3448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\42z1iqj2\42z1iqj2.cmdline"
  2⤵
  PID:236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB78.tmp" "c:\Users\Admin\AppData\Local\Temp\42z1iqj2\CSC8933E763F0E748E1B062453BE731976.TMP"
    3⤵
    PID:1892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l4lo5k4t\l4lo5k4t.cmdline"
  2⤵
  PID:1592
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDE9.tmp" "c:\Users\Admin\AppData\Local\Temp\l4lo5k4t\CSCB53C9ECC7E284777B62514DED02ABC20.TMP"
    3⤵
    PID:888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jz52ywmn\jz52ywmn.cmdline"
  2⤵
  PID:476
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28D.tmp" "c:\Users\Admin\AppData\Local\Temp\jz52ywmn\CSCC45F3C5BF8AB496AB8D4E8C12B595889.TMP"
    3⤵
    PID:5212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4buhaajo\4buhaajo.cmdline"
  2⤵
  PID:2476
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50D.tmp" "c:\Users\Admin\AppData\Local\Temp\4buhaajo\CSCA31BB16BBA844484AC8BA67F47AED676.TMP"
    3⤵
    PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lku34qjd\lku34qjd.cmdline"
  2⤵
  PID:4120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16A1.tmp" "c:\Users\Admin\AppData\Local\Temp\lku34qjd\CSCBECBA37F4BF45FBBCD898D7423F4B37.TMP"
    3⤵
    PID:5804
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4512" "2272" "2184" "2260" "0" "0" "2276" "0" "0" "0" "0" "0"
  2⤵
  PID:2812

C:\Windows\system32\taskhostw.exe
taskhostw.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
PID:5672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "SAMISH.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ciex4hlk\ciex4hlk.cmdline"
  2⤵
  PID:4556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B3E.tmp" "c:\Users\Admin\AppData\Local\Temp\ciex4hlk\CSC876EFA4A1864B2D918E7414A95D941.TMP"
    3⤵
    PID:932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gge5f2nc\gge5f2nc.cmdline"
  2⤵
  PID:2196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5187.tmp" "c:\Users\Admin\AppData\Local\Temp\gge5f2nc\CSC932D35903F5044C8A0774674451B67B7.TMP"
    3⤵
    PID:5312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hzefn55l\hzefn55l.cmdline"
  2⤵
  PID:2924
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5689.tmp" "c:\Users\Admin\AppData\Local\Temp\hzefn55l\CSC7E82F0E4B774FDAA88D67C4CEC1BCAA.TMP"
    3⤵
    PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bp3jdbqe\bp3jdbqe.cmdline"
  2⤵
  PID:4776
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES584E.tmp" "c:\Users\Admin\AppData\Local\Temp\bp3jdbqe\CSCE053454A6DD9439CA218C5E83A3A9E93.TMP"
    3⤵
    PID:3728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u1uxthg5\u1uxthg5.cmdline"
  2⤵
  PID:3944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A32.tmp" "c:\Users\Admin\AppData\Local\Temp\u1uxthg5\CSC201C89ADEF974C9EAF65727F3DE91A0.TMP"
    3⤵
    PID:4816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f2t1fopo\f2t1fopo.cmdline"
  2⤵
  PID:2556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FFF.tmp" "c:\Users\Admin\AppData\Local\Temp\f2t1fopo\CSC9A2ADC24BD2648B99F45ECDF3F2C723.TMP"
    3⤵
    PID:792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\apbvryrn\apbvryrn.cmdline"
  2⤵
  PID:1084
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6212.tmp" "c:\Users\Admin\AppData\Local\Temp\apbvryrn\CSC64EA8948727B4B5DAB444C947EBAD.TMP"
    3⤵
    PID:5528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0cus0f4c\0cus0f4c.cmdline"
  2⤵
  PID:1336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63E7.tmp" "c:\Users\Admin\AppData\Local\Temp\0cus0f4c\CSC7F289B086D2C439094738CBE6CDAB4D.TMP"
    3⤵
    PID:4660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\54pnr42h\54pnr42h.cmdline"
  2⤵
  PID:5268
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67FD.tmp" "c:\Users\Admin\AppData\Local\Temp\54pnr42h\CSC730173F4E9E84A1A8773F8B6A8CC44F.TMP"
    3⤵
    PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uccgii1g\uccgii1g.cmdline"
  2⤵
  PID:5932
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8096.tmp" "c:\Users\Admin\AppData\Local\Temp\uccgii1g\CSCC34B8FF7F22F4834AC20FF4ECB3462E.TMP"
    3⤵
    PID:2468
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4576" "2272" "2184" "2260" "0" "0" "2276" "0" "0" "0" "0" "0"
  2⤵
  PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2tes5o1l.dll

Path C:\Users\Admin\AppData\Local\Temp\2tes5o1l\2tes5o1l.dll
Size 3KB
SHA256 25c51e753b22a20b84b457ed4917b4aa10e9b93924ca5f48c80ed8fa096dd8a6
MD5 9841a38852140d0dae85380f5272d6ec
SHA1 9cf9aed8e35d95fd2bcb12f91458b5c3a7b60ac9
SHA512 c7d39eb016e0cab5321fb76d923a96c7232dfba884c0645b63855b997a891f9159fb14df846600c0e91f0d7508c4e44d61cb72abd7d52a8afc10cf1be80f4f50
TLSH
T1CC710C06A7E94626E4BB0738AEF3031A2375F8208F32976F1984025D6C603705E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.BEACN.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.BEACN.ps1
Size 2KB
SHA256 442c701fc5df6dd8061297f544b83b630516da58fad1a71ef0a86907148d643a
MD5 b80de65a15f4d952b90dd831243a7aed
SHA1 73136bb8d5da9de361214f3f86761dc6fa67012c
SHA512 ec0f70d688dc23b2f207227c7641d8a68ca5e23d6b0f8ea7452dbd1764a99474c8588e7e87f046f17dbca44c3660bfafd48fe792fa79cd7c67438e3ed320ece3
TLSH
T19541CA0A7BA6116A459F147CECCD43167DEE001B1E2E0E31B8BD91886FAA32D55F06AD
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.Custom.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.Custom.ps1
Size 3KB
SHA256 e0e01ca6b68c118ef3bc94770a253578c24633e99dd04a70b8f778edb485f9e9
MD5 1714ac88834488d79228625ce4796665
SHA1 3b6d1132e099838f65c0691a9e3de8acaa5df969
SHA512 bf2406cd48cb3cb62717c4920dc121998e9d9e04ad8c8a611ebb7e5ae1aabf45a997e043ab3976fa4c4d8a3837b00d97ecff70a7a4a2f4864b9801c8415736dd
TLSH
T13F71001ABB3751BA487B5778CC8D051DEE5B046B470A1334B8BC90842FF671E46A8E8E
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.DEMO.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.DEMO.ps1
Size 1KB
SHA256 34224640dd30e308927815ac9092524d543034948a23abfd7fefb9a2c72b0465
MD5 cb49105588c20b7d14b2643f7a193544
SHA1 cf89d7c33e0b2e90b7efd1201c80985bdc3e3a59
SHA512 5937c64fa34b29c644fe01d63b1c99e2f8307b03427c8a3a52086c0a9fb674aa7438d4870fc8cd2c982d39a6f4829cecba650d5e64bcf3a41e3dd5156737b2fa
TLSH
T149310006293932B4C82F82DD95CE6598F9E2601F0B5D3868F4DCC16E6F9E306121E49C
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.GoXLR.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.GoXLR.ps1
Size 2KB
SHA256 10499272a14e3965b3edbc6220e39d18d26be4e8182e123e63e7446cf3a9a351
MD5 89fa38225f1e99281fc1fb1698fa0e1b
SHA1 ce918e76906adfe214137c53cb6ae7c03b180e21
SHA512 8b2723bacfcb5eca3beda20364e1e542d8e47c0b03bfbdbb42e020474e8098c25fdaea842f072acf5f20a31363b401bc7a5d4a07f12403cec8b7ca6d150441a1
TLSH
T14D41CD097F1B512A45BB173CECC8420AFEAE10271E2A0631B8BD91842FB571B45F0EAD
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.Voicemeeter.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.Voicemeeter.ps1
Size 2KB
SHA256 0e04a547d3330bc49b01aa9246026980551ff0ccbc5809b8aa65c2baadfaf9dc
MD5 557d059b38f7aeb860415a2d9ff3b8d1
SHA1 609d094088d7a51fffdcfe86bfb69b29bb6a97c3
SHA512 27a9a01cbd181447a7961f1bfbbe3c1e6dea402a8bb900ced0cdfd6cc16b824aacdb77b22127b19be2ec5ffcf19cb66652c3fe9e39017d007fdfb7929c222368
TLSH
T1CC41AF097F1B512A45BB177CDCC8420AFEAE10275E2A0531B8BD91842FF671B55F0EAD
MD5 SHA1 SHA512 TLSH

Submit Download

Adapter.WaveLink.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Adapters\Adapter.WaveLink.ps1
Size 2KB
SHA256 970184169e7cb568ac662f71bf3cc44752acd4ec224d9878a58f963c7d6981b9
MD5 78a9ccdcaec7399cc8f07af56f879b93
SHA1 3217f22f1e0129548940b6409b188987fd06e4b7
SHA512 3850524db1f78f4a71b1631c3d0ff7fc50bc16a8c5b167238aab3958b309f43ea8eb944fdf657d7b1f75ae95bea30942f10d2893f413a7b8bee80129b7c6abd2
TLSH
T1CD41BD097F5B512A45BB1738ECC8460AFEAE00271E2A0531B8BD91842FB572B45F0DAD
MD5 SHA1 SHA512 TLSH

Submit Download

App.Control.Classic.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\App.Control.Classic.ps1
Size 6KB
SHA256 490e09961d2e724ef3cc8e7368570929c7cf703cd15cb64aa5067cf9bacc6634
MD5 1ae7152332dc8332896471c665674b33
SHA1 9fa5c79645ce256953cbef76b9fcfda1810d56d4
SHA512 55b1ef3eb513ed720a586bafd77cc9ce745a82898c7f8b7427893f832517ded49fac151a99fdbf08295c26bd078ba88c20bb3be4cd9ada3739ddd53df4d18bc9
SSDEEP 192:ZFyFx4sbg1ZVDq7VFqfcGCExAjJYx48JaV:ZF11Di3
TLSH
T103D1EC05222E115F45B76736E997621AFF9F25374A190610F8ECD2803F7471EA378F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

App.Control.Common.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\App.Control.Common.ps1
Size 13KB
SHA256 20be79167f7154b419390e4bc86bcdf5573d94c3074d7b37a6356c65fb716de4
MD5 6c5b12182b1ab5bf99c26a30e2249214
SHA1 b17ec9486a2bdd1617ab57a28ce5394fdf27628d
SHA512 7754bec48da2af44f59c77dc007b511482228fa2cbfa3b77310192da653315e9d100e0e7298e2577741c6dee537806eeaa17d4ad0a5b25e9aafedc084c431f50
SSDEEP 192:bn2EtMVmXMWDErzNSD0wAqkxYKFHRjxHg+Pqxfo52gDqh35jVnrk8l2TIRq:bn29RRjWdM2gDKVnrkpTIRq
TLSH
T1225243002E06815656B3CB3AEC976119EF5B513F171B0228B4EDC1885F74B6EC36CFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

App.Control.Graceful.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\App.Control.Graceful.ps1
Size 9KB
SHA256 f0ff30696d7e511b464077e41d9fef4923a7e20ed90dff8a7c5af271b1146836
MD5 92d91607c06b6c8dae67cbea724373e3
SHA1 86bb33b149557e22578ac5057e5eb8e3a5518aee
SHA512 a4f42e8b1681cc6c713360887b8bae49be54abd6fbcd8aba1c1d8ae061fda8738d376a714ed45f357a072825c35dae2ddecbc6b55edcf1df0e2c9786ddb45066
SSDEEP 192:ZYZFDdvEPkjPN2I0+RwzPbrJ0rPJHOPCyKx/AD2lOOh13vPy8wqiKTJPjBx:ZYfDdv3J2IrwfrWVHTyKflOgTwLEx
TLSH
T1FE12E004764D209A14734339E957A61AFF9B117B8A1B0610B8BCC248FF79A17E7B1F8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Diagnostics.Module.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Diagnostics.Module.ps1
Size 26KB
SHA256 70266b5cf08e5e988832ce82014bb64c3d05e3c107be08bff363f9266992ab78
MD5 91d8c3aa661bac2f8db8da79e3f60a58
SHA1 71f8faee6d70ccbf670e54201ead4e54065a7761
SHA512 871e64742fa568804a06fc81910be0973493464cf06f1712fadddc98a5c75eba46b6b299f0ae9cfcc58ef49b1e54369951370f1084c23c78dd5abba3c989d1c4
SSDEEP 384:DT6c3plKEbnGOxr+GOY1vN10mVKJZamG/xJ6iqaq6dHMu/F:DrSOsYPGob
TLSH
T1C5C23F29B906213A92B77735EE870408FE6B016762150214F9EEC5CC2FB9619C378FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.Engine.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Install.Engine.ps1
Size 3KB
SHA256 e13253db224ecc85253fc7fcf5b4952f326648e808cc7f753896a0e545cea21c
MD5 6a8ecdbcad7ec59f4740290f34f5535b
SHA1 95e83c514c87e88a9ab8d7198b60c14b43730414
SHA512 8cd55a9c97655a45c7a9fb8768057ab5f350e8f915af024b9f09a3a4aeaa58c687f0a5146254b8ede2bf780a3460e3cf4483e1d288f04b6a9cf4160496978151
TLSH
T175510005A9530DBC528D6795A9895480DAF244EFDE0C3C3074FCD1AC5FAB39C85E1D9B
MD5 SHA1 SHA512 TLSH

Submit Download

Logger.psm1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Logger.psm1
Size 3KB
SHA256 59a40c1637e0fff2330190be911d9b73279f5b05d0f0da3f5c4531a5945c6dd9
MD5 17a7294e7c6b1c54248b4693f3014434
SHA1 d51760841947db2b9dc9363caccc39adee0348e5
SHA512 ed71a7950965430e2620aa21be212f7d05ad283a51e7a863a57e6036571629250481c6df5feff1861a057a36d51f21593fdfd7c9dd76de7a11d299e00644c32a
TLSH
T11E71841A696016A456DB2378BF8E8480162FC0BF85458B24B4CD9B849FB1B39937D7C4
MD5 SHA1 SHA512 TLSH

Submit Download

NativeMethods.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\NativeMethods.ps1
Size 21KB
SHA256 65f860897ab5f504d4e97a9d82970569d6be6e331b0649568f8c7bfa0537fd9c
MD5 f7c2e03ca8fc897712445a478e9d39ef
SHA1 d3a0444f42e793284842e11126d65c0e1eaa43a5
SHA512 5a338694479007d15a0cb9c0f75e987ae73abdd6ff91aec1a237df92ac158bf16d02b76dad4eb5967ba082be59e72f9ba3093d18e93af67c61f4a42fdfdeb2bd
SSDEEP 384:X+wnqA+hqJ73VDSyHQSSMO5SS9+0oFRPqkd/ch9a/sSNzur2CmpRjLaAI84zLAr8:X+yqA+hMScS8t//ZXRILr
TLSH
T120A2521B7EBB95A442C7553B1CAAA2483736A033058D9E38789C87C0DF593B48BF4F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerPlan.Module.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\PowerPlan.Module.ps1
Size 21KB
SHA256 b0a11fc36e29e3ad9afa99bcc7df738fedc7541116de251d433f3a0a7dee2984
MD5 ede75f9936a9cbb93f8bb7b520c6b10e
SHA1 8e872abd64a9d192b8bb7da651d56874a87dec99
SHA512 12a1e2310571d060e0199df5a0574e928afd5aecadbc28dd8aa5124d5798f01d2153701c5e29af8345b260a4a9c8a3a3543117e25747d3f8a799492968d41bd2
SSDEEP 384:RLGhbxsWvQjOJ3LYnHP1awdlJKQgr7Cl7C5yvyjnd7uq5S984KqztMz:Z61c8L4PqFMzS
TLSH
T136A28566A883595857B3533CEEC6312CFB7454231278163AB8DC2AD85FF199183BCF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerPlan.Read.Common.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\PowerPlan.Read.Common.ps1
Size 2KB
SHA256 ff0a8296a4aa064fa6b8fc5d930bd6153bbbe2be99d7d94b1daa50832e86e431
MD5 b78b202b18780dc4e9858cfde3461af0
SHA1 5e0aa9594787936db4c0aed799ea8539fd565d7b
SHA512 48d0f163d7fdf364a53c2f3ee2a2984e25c4885a35e6bb3672348696cca31c1e38bbce8bb88aec820e05181b920e098f7036aa32a4fcbc1dd49876f13ab3dd29
TLSH
T1E451FC99155BE0191B335BBEEAC61418E706313B07780531F9FC98542F71B6492E8E4F
MD5 SHA1 SHA512 TLSH

Submit Download

UwpMedia.Module.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\UwpMedia.Module.ps1
Size 4KB
SHA256 f0b1c5377c14120bb4b337c952c643682711ac6e564a29f685c7cf69f2c0f42c
MD5 a06c360928b0d246530d1227bef39531
SHA1 0be5e9feb3c607544a739ce0ce304000d0327464
SHA512 07ccc7fe7786a12fc1af71e8e558d8afdf062f9f524dff5c6799bc19ada8f49130332f6c21ba7101d95f2f2bf14bb63c7ab3ab2cfd6d186a8b286b7277a59c13
SSDEEP 96:Md1m37fjWGxE/LylSaR/8mQ3AUE8+xA3hiyiRN7WgiRjGQMiyod+xMiRK:A1afjWG/lbR/bQQUE8+xA3hiyiRdWgir
TLSH
T173A114497AE6A07042CBF07AEDA544497E79482B311D1D24F8EDC9D8AF25B37C3F0698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Validation.Module.ps1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\Modules\Validation.Module.ps1
Size 8KB
SHA256 3c655a7736c8b916fb10d2de463f960d6a758939fa3ec60a6e2d6b337761dfa7
MD5 b74431c9f9324b112264e0cf2fa4d552
SHA1 e06769db8a6b6a3a4f3a4c3212cf2d264b56b47e
SHA512 0b02f54fde519023140bf58ca6dae6b1f932fa6cf86812d23035a30f41be4fad259bd749ede59aed7752d5e04ef266d7d2154f8b4a1b382c332d43fe7f2f0bca
SSDEEP 192:ykzcMTsTiyNiiCC5ynfyi5jeSiacM+xi1ipAJsAGjhitcM++iGpkdpZAn2:ykoMTsojxbJsxjGTCB
TLSH
T11312735A7AE4136A295303B4B99E0445BB3F805745182B14F6CFC2C09F66B358BB73DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Setup.exe
Size 125KB
SHA256 2ec0dd96176995bb1101b374de56488f18b4a1e74b512e537f108258e2b9224a
MD5 0e8d096374604d0a867e752492614e02
SHA1 b623ee65dea67fcc3d82f6fa1ead8c93d6db3e0d
SHA512 8bdd68bd7c5c3832d0a468c0f651612af75c8e4d8f7557e21abdeb0632555b7e1931034cc78d971f83c570d073cd5311c3f0e2707da9ad481b1c80b7c7d10ea5
SSDEEP 1536:Uq9BBNhRL/A3zXe8RJKTyLUWS+r5aY0wFZ/0FrxQiMK98hZAOAAT:UaX/AjXHKTyLUWS+dEieFrxyZAE
TLSH
T17BC37E11AD05C126C0FE5B3DB8A69459EB33692B0106D3893CDCA5C93FB2BA1452EFD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\build-tools\node_modules\shebang-regex\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

RES50D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES50D5.tmp
Size 1KB
SHA256 8f44cbffbe3708bdaf5cd8b6905ae01fbb57a68dcfabdcc4c08fe41bb7c17a41
MD5 a8ef20e915002eafbdceb72472089acd
SHA1 b3bfa03faa6fe389a018521def01c73428886cfa
SHA512 87010d90e14d3f201e5ad9972ed0da2f0c0be66820de4dbbc9c23dc65ebe87ae94bf1f9eb11af04c022d788edbac16371e43422355f6442de2faadf85713bb57
TLSH
T193218C0593EC871FF0775731A9F6172F9175FD64EFE1539A858052282841604EEE1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES525C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES525C.tmp
Size 1KB
SHA256 eafd237d21934a8b87a277697ac34abc1b50f46c95b1ef8e7424bfff56401e6c
MD5 454c07cb544abb8b98c9057ac857d8e5
SHA1 a65f3fe93e2c5e10e19ff85184cd0c295aebdf3f
SHA512 8c543135073bbebf7d9497d026185cd2947decce1f98278cd6ee48f6119ed79124f3ef3eb804fe18c6f5068d1c6afaf454f95162cd62c8ab0c5e42c4dff3dc46
TLSH
T193216A0553EC871FF07357316AF6532FA174FDA8EFA2579A454052292841214EEE1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES5327.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5327.tmp
Size 1KB
SHA256 b53f8cafd7aeb0f754e79e6930709b20d9f353c1644004c52b785386157c0fc0
MD5 f8830682e9e0897b632dd6d1c6cfd93f
SHA1 b2409d46a2ba1b8c3b1354191ec55b1066d904a9
SHA512 574b682ebc7dcd8653470b7de9a628fe7c43caf5191106e990b061ef2c90968b23869597d758a59606fe995eb219cf2d724865428c85651e0bfd515a3e747a08
TLSH
T1B921CC0193E9870FF0735B31AAF6436FD374FD68DFA2939A8440421D2C12544DEE1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES53E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES53E3.tmp
Size 1KB
SHA256 56c942b98c99f4dca3aa037b096eaa3f4b9a9973711de88e19d20137edc06379
MD5 badeb843506c640548d1a15f6dbb7ce4
SHA1 b9f7b910c005a68987238faab9b5c1853f76ecc7
SHA512 ed2d2be1a2a188f3ca3bf4e606e45b99f7525782b9642762dac34525e8f217b251f6a546ff6d08551b31497c1ead21566d93ae7888e3199e1ca22dd00f534c37
TLSH
T1EC21AA0553EC871FF0735B316AF6072F9235FD64EFA3939A854042292C41214EEA0AB3
MD5 SHA1 SHA512 TLSH

Submit Download

RES5EC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5EC0.tmp
Size 1KB
SHA256 060c5bcc297a1d5f62a0406ce24b16c0029a2f60ef01fe249ecd096519643df9
MD5 1254097be3dcabc6bc139c3a12c2445d
SHA1 d3105889563620e041ea210ecc2f8db1aaa7278e
SHA512 193db26bfad9fb239a7c1accd9671246b9814da0135543ef68773e84b65d9d63214f08ce6b490e0433b98ef49f6f4a1dd4ca0319c9b96a3e270d798caaf6424b
TLSH
T15421CC05A3E8870FF0B34B32A9F5172F9174FD68DFA297AA4480422C1C11104EEA1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES5F6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5F6C.tmp
Size 1KB
SHA256 696416296201c31794792e9263fecd80fdd32a88cd69df7fe12d160938248ab8
MD5 64bac1f877ec003f071dcb691cd97566
SHA1 d212a4a6d4b53a6b1e8b91edc22a98ad3aeaa338
SHA512 98028d3cd7eabd861f6fa73b8cf64a2737fa4070d5aae76b4ff1bb144e6d2eba1bfe114a578e2779e9a5b52e2479e3e3ee73246a52fc6ee70240db3de961a3e2
TLSH
T1E121AD0593F8470FF0B35731AAF6172FD674FDA4EFA2539A854042282C11104DEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES6008.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6008.tmp
Size 1KB
SHA256 4740f88a344b323e8f74f357690c62d8842e5fb718ac707bfbe4a74ec161a643
MD5 f0cd13b4c90a3562030ca2530164c23f
SHA1 47b673c98190c79901543827a9822e22a8656549
SHA512 272aef8fb247c41754b174e1ee27180256c3f69ea7b84b5b90cd2e2707e6bd1b744a6f457b3693de5f54582b822709cbce5cf8e2002027cce5383a2903c06fb3
TLSH
T19D21C00553E9470FF0735732A9F6172FE174FC74DFA1539A440002281C45504EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES60A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES60A4.tmp
Size 1KB
SHA256 25d069333eeb6b74b5f8b2a6a1e14245767a91e050a271fd719216675d33fd68
MD5 b6399360d6d04b95f3c4de687e562eba
SHA1 bcdc5d52d58c9311442314d66c79110cfc928b15
SHA512 7362a52c2931c5f389127ec87b51e9bebad45bb0748ca2c74d5361cabb4ba02821228cd93ff43e736afae430d7512306a74d22c3eda69a1babc3e1a4060b37fc
TLSH
T19121C00593EC471FF0B3573269F5132F9634FD58EFE2575A4944411D1C01514EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES616F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES616F.tmp
Size 1KB
SHA256 44052a469ff6a09d8f7adaff39f599bd8b14d0a116babf66315f3302b6ca9424
MD5 7a05195a2c65aea4f6893f0351f2d0d5
SHA1 d60186dbeb2881ece7b4831179ada560ba88e387
SHA512 6bb647b5f0bee77a76b5969982349f35ecc62cc87c5ea9b45502a437dafeb9690b7ad2f243317b0ee45bb17f7e16ec3e7190dd7595940f9903d5f1bb5ff2b1f7
TLSH
T1A121CC0593E9C71FF4B35B326AF6572F9224FE98DFA2939A4544422C1C41504EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kan0q3kg.csl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kan0q3kg.csl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

caf43iz4.dll

Path C:\Users\Admin\AppData\Local\Temp\caf43iz4\caf43iz4.dll
Size 3KB
SHA256 cf5d154ff42099c83f82d824518c69b3dedb07803928159f4e01b7628ba873df
MD5 693ac8a7817badaf0f75cfb7fb00738e
SHA1 b3ca6a2d0b3aa11cc180054d6e8a3a7b7d8594a5
SHA512 8b597145571da38586b6c863282dc2e09d0ecb6f286b448b4e814283d23d79fce36aa4cbad40a2b45c2830bf6f2b0591cf93b35458d80371ba99370a7a10fcc0
TLSH
T10A71EF13A7A8466BE0EB0B746AE353172774FD609B73C32E5D84111C6C606945E71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

evob4zrw.dll

Path C:\Users\Admin\AppData\Local\Temp\evob4zrw\evob4zrw.dll
Size 3KB
SHA256 2652d6684e899507c2561610a8f4a57862f50d1bd31e07696bf1c8ab3f01f98f
MD5 2afb3f0507706bbcfc4a762147191323
SHA1 30c001fdd616ad910bf5e5df44388533e328c239
SHA512 be5dfd21bff0261cfad32e708de651ff6355d8c9303334b88aab920a35a9b23083c80ba7a4652344e1053da25e47bc42fd27d88ffd1b54ef917043f2743e672b
TLSH
T1B051BC1BA3F4466BE8770730AEF3031A37B4FC249B72975D1890022D6C606245D32FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ijw2yp3t.dll

Path C:\Users\Admin\AppData\Local\Temp\ijw2yp3t\ijw2yp3t.dll
Size 3KB
SHA256 d9b10aa3dc5ab243ddeb0173d22108ab573391570b84fa07781b1a9cf3e00e60
MD5 ad9bb521e805699328dc50086db973d2
SHA1 facdc4ca0f08824a1cfb07ad7d9f03637bb13834
SHA512 33b15d3b8c32cb69581b07397cccdd069fe6e00efcb8eb214feb5e55d3d39acfdde1d9d222c68dec415bb86adaad817ca73918db81192418a91615e9bdd16d2f
TLSH
T16C714216D3F4856BE07B07346EF3572667B4F8509BB2676A49D04318BCF22685A32BF0
MD5 SHA1 SHA512 TLSH

Submit Download

jhnmevvy.dll

Path C:\Users\Admin\AppData\Local\Temp\jhnmevvy\jhnmevvy.dll
Size 3KB
SHA256 d2872f6867cd84cb356c67b7df461adb7008cf1a950ae8417682c6f98489ef64
MD5 0c96f437a20488170d5d5fc2889ed00a
SHA1 d6581fc4a7312a98847f0fae3ffca36dc3630738
SHA512 9a6f50d5e303645667806a80d0c34391563bfb01cdbd891858496cc336fef2460f102e598ca7d0f2199a98ce1a719e59965a3d032afb4b8dae88a954ecc99751
TLSH
T10D511F0A53E8462BF4B70B31FDF3471277A4FC609F73572E0890526AAC102644E72BB0
MD5 SHA1 SHA512 TLSH

Submit Download

kgxxmj5f.dll

Path C:\Users\Admin\AppData\Local\Temp\kgxxmj5f\kgxxmj5f.dll
Size 3KB
SHA256 931f39f9a0798891e2c0599bc701c3e41a3361327543f28f56b40d8c6827d29f
MD5 d381e7f974bdf76c3cf6e29140c5b59e
SHA1 8ecfa690097d57b2ba9564c7d805f0a28efbcc79
SHA512 4b0d80cb8f4eb6548d6e319a1f4643e84efed797b42a342e7d46c2fa07809130035e3b1ec3c8b73d8a79bd7f11c2c43d9289d1d0b73b68200ab7675ff3ef0ffd
TLSH
T18E51DE0AA7E9066BF4B70335AEF3476737B5F8108FB2932D598002296C243545E71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

my2tqgqx.dll

Path C:\Users\Admin\AppData\Local\Temp\my2tqgqx\my2tqgqx.dll
Size 4KB
SHA256 474cdbedbf11284562a78b5630d32c1ff1f9901a0036dffdbd4791e68261cdb5
MD5 7b77a584632de47f4aece911a700d143
SHA1 218731e7b2d601945d903bbeae95f07b610b4c4f
SHA512 50b2713429cab09764675593b0b80bcab959c5a02852b4771b59317e18cb37930f194bb661c08d0005b64887e6ffec251f0347a2d4bd5c7c08704ccffef6b0a4
SSDEEP 48:6N66+KZhBZAZspuPgWPvI/Fs7TuEXEdpqsJpMPhDCmVt5I44KnKp21ulva3Tq:oFfh7WsQPgWOFs7TucZM1mVB4dH9K
TLSH
T146913F27ABA8C25FE0EB8B3829F3175B2334E9619B53C31A1D8051A8AD512542D31FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ts5zk4f5.dll

Path C:\Users\Admin\AppData\Local\Temp\ts5zk4f5\ts5zk4f5.dll
Size 4KB
SHA256 1d64a91c8832b25c95d13b2f4f4fc57d0cfaf14bb9a3c8c9e1e2487d4d9e8b9b
MD5 227391af6cc63b2d9571ad6c2f21cd89
SHA1 78809a6f7e9057845a33c227341eddbae012b6cb
SHA512 13fa3c505572403351979c698e3b18991318176c49b03e2420720b0892437903c925d85e496c6b8e4d8cc80a2dad4facf6822f490908eec5178a948c6ea85fff
TLSH
T1CA818303AB594A3ED07B07356BF3472323B5F9A5DF62E35A2884466A6C523504D37BF0
MD5 SHA1 SHA512 TLSH

Submit Download

wjy04ro2.dll

Path C:\Users\Admin\AppData\Local\Temp\wjy04ro2\wjy04ro2.dll
Size 3KB
SHA256 0c49c90b656f0e654a6dd91f08a03f7b72bae597f379eabc0104ef9fa5e967a0
MD5 7eca4df00c28848bd1509a963f1d85e8
SHA1 f88248bd9ebae19acc44eb2b05f66cd99a10acac
SHA512 600354db334ae1bb519989701bba759a1fa04488d0b39e06e66db49a4cb99b4ed8a9a29d1602a601b099244e1b917adcc6b4b56b4936c98b6e0ac5afa51f1c62
TLSH
T12951C90BA3E84A2BF4670730AEF3072A37B9F8109BB3535D08810318AC613545932FB1
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\SAMISH\config.json
Size 954B
SHA256 4798a2fef12f78d5521ba25b09effc73508cab8c73dea2d6569c0e73eb16f705
MD5 1b5b61291ee66992565ea538df3ae45f
SHA1 6c2bf7d685635e27ac6967f53de95abc8d0ee881
SHA512 5ffdd7984c48249c2bf1dba48cb8e3bdfca063e03b220f91e162b93b50ecc55b92474fa07e65deeb3d9f4d36ef87e7b4e29a02d25a97b7a2e24bdb3169520733
TLSH
T10511221BCC8A5E6860B085A49D7D0A4BF28057AB3524742BB6BC018C2F3FB2020A2D59
MD5 SHA1 SHA512 TLSH

Submit Download

2tes5o1l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2tes5o1l\2tes5o1l.0.cs
Size 546B
SHA256 0df9ace5a7d8a676dbf7495ff4953736c90a12c32a17f1530328604b71fd4b04
MD5 a1802ee362622da4b6be1d2fd31e080d
SHA1 88c7c87b30d6c83083ca618bfe26eef4b01af527
SHA512 f597b1d0c30de5cbaabf36b1b1062a27a3ca739d217daf00e1731ac8fdb45820bf4b013635053efa523472515c31ade0ea13431c6fd7f705197d7c6aaf83ae3b
TLSH
T184F08B2932E7C9B652173009BD4362DDF72393217D996D05B88203E28E4123D0374BA7
MD5 SHA1 SHA512 TLSH

Submit Download

2tes5o1l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2tes5o1l\2tes5o1l.cmdline
Size 369B
SHA256 a6479638040b3fc392d3284856903eb54087ecaaac22b7a2e884a410958c1831
MD5 796ffcb06565f4361b91ea81e0722fb1
SHA1 d09908e640a9fec68e4d5714fc67a063a39ad8d0
SHA512 5c7cbec4c9db9ee63e57a58a9131cd79e9e3b8f83a57fed2b73632aad50e32e180c8393a4c412938d65c20a06a2374ebccf7ea7c372addd0c4c18f6c1d3e414d
TLSH
T146E0682A628AC67D09D9111766A9C4ED8273D6832B433FDC5048841FE0B708027D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFEA277C71224647906B40B62BD7E3D3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2tes5o1l\CSCFEA277C71224647906B40B62BD7E3D3.TMP
Size 652B
SHA256 2ece88f2b32a3272cc747cadc4bce9cab9431b0d7604e58db0acffa95d0bcfd9
MD5 4a390142b5e6751b80bf0e1c6c0182ab
SHA1 893d10a2fc97780ef0e840992ab5d3efa78d44c3
SHA512 b30d714b1de446d8863c719b3d984af4e3763790f632d8f522669430fd8ee6718baefa95959054757629d024defbd9dddd28e29d70e2ea2e0e42043087340b97
TLSH
T1ABF05E0963F8020EF0F34F30BEF643A391A9BC65DE3293ED5490035D28646109972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD48677E039E1407894CDE173F7A35048.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\caf43iz4\CSCD48677E039E1407894CDE173F7A35048.TMP
Size 652B
SHA256 0554f716b528caee64bbaa5e55515e4c89d4647ba060e84d56424bc1147f8fbc
MD5 20c6c7186422fe6ed79793121868fbad
SHA1 5ed8d81e280c16af311f2a61022446c163ccc5b4
SHA512 7e1a503580cc27ab49ce8a65792646ce1b60c3d8fb716ffcdd5c2c12270e5f04a511a74c150987c3cd4f904bdf971b66fd2bb9eb693cbf675945178ea73ae306
TLSH
T132F05E09A3F8120EF5F74B30BDF6436395A8BC65DE7297ED5544031928649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

caf43iz4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\caf43iz4\caf43iz4.0.cs
Size 749B
SHA256 b6e0134258cc62ee6934167fc6d0219d35caed2c6ff03617a9358f3cd966ada5
MD5 7c1ba58c506397c1b4677e2892f76fe1
SHA1 662e1b6313437c127b5e7b1a20b6cc0bc0e6af96
SHA512 20653e82608e5a13cbd455f681a405456efdfbc4ccc9f7259c7aa37a4fe36360a193621619e29609f5b352bf4ab9c0ba7bac99c83e87bf5b73d40a4cdcac6e83
TLSH
T1B401994B62AF4055C016E5160D08B549F23E78630EFA892C7C0DC586FF05A98C8E0FF7
MD5 SHA1 SHA512 TLSH

Submit Download

caf43iz4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\caf43iz4\caf43iz4.cmdline
Size 494B
SHA256 3afa2f9b0b71f1abb117082101e888eddd17ea8782992eaece8b116b8e57a3dd
MD5 eea3665b04369df7cb1ec0ac90bd4873
SHA1 0554ef6cebf0adf1d4d6fc536ec1b246ab86fae7
SHA512 def259eb415b4c6097f575e25598efe1b8492d9cf22a2700a1a7549aded5b6df1c74d47974702b00c27f59b731e5f1cf60ad654d1dea0cd2dab476ca6073690f
TLSH
T150F09E35923BC2B941EA2107155EC6DCD53B039734827F486990881DE4271102B93BC0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA737E11614374F85B39C7D5725A6AF7F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\evob4zrw\CSCA737E11614374F85B39C7D5725A6AF7F.TMP
Size 652B
SHA256 f43dc8a017c607266a1036a3f2b70ca2ac07819838707fc8f0c626fdd362039d
MD5 6248ec81d05aa91c65af10ee740e238c
SHA1 46ff84363568037e8a1ea99bb3c7adc044eb0e63
SHA512 ff452698c3809618fc33e9b76977f93bae7fb8bfbc034280659fd8bd651cc2ec09f563d87db9e3b8f02dd5a09f73a87b9415361888f8482386994a0aebddf624
TLSH
T10FF05E09A3F8120EF0F34B30BEF643A395A8BC64DE7293ED145003292C745108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

evob4zrw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\evob4zrw\evob4zrw.0.cs
Size 178B
SHA256 907a478b8974968bc431e39fd2453f6a2c415a55bb3edab44436917ddc7d9af9
MD5 2179bc6a19e888454b6cdea15e7fcbc0
SHA1 bd7d3d23c2a59861dc2227319ffa68258169e034
SHA512 1fcb32b00f344fe35a6868167e143483a677261cafd390a94a6cf2e6cb2f785ca5c25b43b117c811e19a57a333e8fa05bd116db88c904b2e770a678d638ef48f
TLSH
T19EC02224B2B3D9289C8350124C008298FF17221972295901918816448E4601E023CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

evob4zrw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\evob4zrw\evob4zrw.cmdline
Size 369B
SHA256 3790ab611b3309f9dbb2c980c8c3c22b830747b13df4093f2ec104cd732acf86
MD5 5931b91ffb4fd3e635a295607d1f9461
SHA1 bb893d230d46f5ca6a938416a2a44023bd3f3f9c
SHA512 6cc3f96b5fcbe82aa8390974455425cfb901720f1ffad5a2a311a7a86d55ad0cb528638165350c04d0db68c69e755aaa66a3ad925e83ea4770fb35dedce12b70
TLSH
T188E0682A4246C3BD11ED104B2169C4BDAA72078F29503F84A040984ED12700027E2B51
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1EEF67B0C744379B72088A46DBEDD5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ijw2yp3t\CSC1EEF67B0C744379B72088A46DBEDD5.TMP
Size 652B
SHA256 0b1de2918fef5c56ebeb9c850241d7312c2ffb07b333d54414c8dad535b3309c
MD5 1fee87c5ccb95256b069a75a0bd45a3e
SHA1 fe7406622f96543a4c404e2bd7ee3371dfbdbb0e
SHA512 a02b9a87a14360b65d8df6e773664315e73a667760a8d47d630b1540292984b31bd2cd3ae4045ae600f26886983dce0f11e873c7ef46cec2e0ff9f228c597659
TLSH
T140F05E0963F8520EF4F34B30BDF6436391A8BC65DE3293ED1490431D68745109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ijw2yp3t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ijw2yp3t\ijw2yp3t.0.cs
Size 858B
SHA256 5545ac6665d14d6ba82048374667ed66b4af00bf2a09dd70fc1689466f43717c
MD5 7905462ea2f64fb39dcb797934c3ee03
SHA1 259d0528f5108936a2c3e338284243eb9787bd1f
SHA512 9d22e9283a00883a4ad844224e9d0d8bf7cc043c86b6e5998a0ae420969090eb3cfa41081b0a2ff43266648ba4d5b8a399badc1d9772cb58e7b871ab53572cfe
TLSH
T1AE116B10F6329AA13933440A5CCB98BDF61B4033B2FB2A04957527329F2B11ED435BDD
MD5 SHA1 SHA512 TLSH

Submit Download

ijw2yp3t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ijw2yp3t\ijw2yp3t.cmdline
Size 369B
SHA256 8dff7a280782085ce7fa085862ff8ce36d5294fe318a24c9ebfb9c1803b2557f
MD5 42d61e8777f49da80ebdb4a06b816ca0
SHA1 2a0702cd9e9d28cf466b34e6e6b2e7daab43cb77
SHA512 1b62abcc95f3c00a41e234e7be6489740293e44e3948cfd0c0c04caf8d0e343d810ebd8bee2564eb6660efd5772064efc1b40512aff54ef2b474403eef4f9b4d
TLSH
T12BE0C66A4247C67EA1EE104B327AC8ACC672078329A03FA89050843DE0A7000BBD27A1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC44FDF6B640AC431998E57FE5AE8650C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jhnmevvy\CSC44FDF6B640AC431998E57FE5AE8650C.TMP
Size 652B
SHA256 0a082d1899ac80a2ac88513c1197d7d54edb4e7b19024e114680b1c7434f0d7a
MD5 cf4db3c5d8c5cb451127ced1846fcf34
SHA1 c82ce059866098223356071ed4c3a06a41bf549e
SHA512 1f2b505ffaa588f353706abffaf71e3f8439e29a9116cd31f0eaa6a6aafa15c401b7e734c4f9371a32355a8150df6a15fc2ee075d3b351080bb986ff12da2b86
TLSH
T141F0540963F8020EF0F34B30BDF5436391A8BCA4DE3253ED1450131A586451089B1FB1
MD5 SHA1 SHA512 TLSH

Submit Download

jhnmevvy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jhnmevvy\jhnmevvy.0.cs
Size 256B
SHA256 bab36ad05f649896753b585a86de18697614bab43a0041dc327eefb400a0edfe
MD5 0d41a4536e5d4006e7109a4cfae18634
SHA1 694456b545a58d0961f1d87b2ef71217d66595d6
SHA512 4a1ee3e686e77efba3633375f387f0bbd126a0e00bea8e2db2630ee446b8deae4a58e7fb29d22cc3015fd3e08130e247966f83088f1931a5179cd3cb1a50446a
TLSH
T116D02B10329B6A59812B0002AC54A0996B2751150A762C00EBAC56218F8B1147234B3C
MD5 SHA1 SHA512 TLSH

Submit Download

jhnmevvy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jhnmevvy\jhnmevvy.cmdline
Size 369B
SHA256 4ff4c3d1ef89d7dd9fee13e0a34434380045d57170fb141b373d5bdbc5c2caff
MD5 7137c6df1fe019c988ba18dd6f626cb3
SHA1 f7bd9beb155e530dfe4a964b1d40c40f28c7dde0
SHA512 380752f21bc46c10d2515ea33129eb98de43d2d00f647bbf6c23c2b185bdedee6df5d2c14738fb868a9d7c895e24bbd4571fe5018630c5a370c65ec3cdfaa263
TLSH
T14CE0682E7366C67D11F9200B71A9C8AD82724AC32A803F845040449ED2178002FE3749
MD5 SHA1 SHA512 TLSH

Submit Download

CSC857C8512A73A43D5ABDA94AC9C1D81B9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kgxxmj5f\CSC857C8512A73A43D5ABDA94AC9C1D81B9.TMP
Size 652B
SHA256 9d044173cc3e444a0d1345cb71201f825b609b31253c76140241efb31c661568
MD5 6ec16820f5f9b189f01b207d971ab6b7
SHA1 30fece30f1941a3a736546d6a9b09309e9f4946f
SHA512 6e3b7dd5e76ce2aae6adf8b52eb8a1e94b5cf17c99b0655d74ec14198abce4ebf26c855ccebaf7b0c9f8a6b3e20273c1576dd17ce023101f3caf685a100ba0c0
TLSH
T118F05E0967F8020EF4F34B30BEF64363A1A9BC64DE3293ED144013292C695108AA2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kgxxmj5f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kgxxmj5f\kgxxmj5f.0.cs
Size 221B
SHA256 11a4124bde28b07c3741d9ace74559c6cb529e99d1d33a074241152a05ce44c5
MD5 9f63d060670650e7caf4b12b433e7cfe
SHA1 082bb6e8102821aa85f70f6ef4fe114d16c06a20
SHA512 2aa1036345f2e186543315287a8c7a29a86be00ff09391ea34f219e905bd4235982db7072398277c4af9d4be5f006bd537bd4a8d4fa1d7c0c1ee37c104efdf29
TLSH
T1BCD0A714B7975922381204164CC4A4AE6A2792255B3E9D00B5BD0A224F9B2559138E79
MD5 SHA1 SHA512 TLSH

Submit Download

kgxxmj5f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kgxxmj5f\kgxxmj5f.cmdline
Size 369B
SHA256 968f0b3dc9315ed037b88917f72197efe18ce13944c53050699fe53f279bec33
MD5 05f5bfeb6d1a96a747525939066ed99b
SHA1 138cbea95b06c81980ef4d635da6e5118924f0dd
SHA512 fe26df9359264320e63796956752e607255305ef31b5193d5dabe78bb08658d0c3c4784e0c5cddc254c20c2d1a69bd4e79cd4aa0039f52965a66edf4d8efaf1c
TLSH
T1E5E0C62A43C7C67DA2FD108B6A6FD8ACE6B2078369803FB4B044840DE0270092FD37A5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA35CFFEC6CBD4CEEBAEC277A4E62A4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\my2tqgqx\CSCA35CFFEC6CBD4CEEBAEC277A4E62A4.TMP
Size 652B
SHA256 17ee7a14e1ae2f1d255350f030396fa7ece7656a852073a49748d83b02364a0f
MD5 b8b5ef3d9c852a88ac5f5b0a87c1ec11
SHA1 af60c7d25c061d431fc444ee8f21af6848a690b2
SHA512 2a800adfa4b5d673317318f92fad934b15179061407e9880c5ad63e7eacad8a7cea80b89f3e9845b11192637ca4226e9c5cd2d076439a71d705dfe8edbc6436f
TLSH
T128F05E0A63F8420EF4F34F31BDF6536395A8BDA4DE3293ED5480131D28649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

my2tqgqx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\my2tqgqx\my2tqgqx.0.cs
Size 1KB
SHA256 68952b449c14397cc173fabcedf10619f6361599a5574fbabb8e49b26a92ff2a
MD5 341bf463543eee224552523edf85ae91
SHA1 f518ee3cace794fdaed14adc9fd3631e7472fe31
SHA512 f9d84a37e6b0d9bb908bac9cf0610e8029a6be00bff4dab75aa6da184db1cf05fddf02acedd02663efc80e8afc529648996f28e4eca98615ae36f4adae50d1fd
TLSH
T1DA21EF1B63AB4064C113E02A0E486448B337745309DACA1C3D0ED795EF019589AE0FF7
MD5 SHA1 SHA512 TLSH

Submit Download

my2tqgqx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\my2tqgqx\my2tqgqx.cmdline
Size 607B
SHA256 483a7dab8f407d6af6160ca92f90548ef924822b0bd0dacd42d5403c89fcd956
MD5 cbadd7a6a1484d3e22e8fdcb6b038953
SHA1 f1bf11c7a842b2353da6cd6422140e44b5f6d479
SHA512 7b0aa42f32a73bba6b7d91266ed05646d49d39e27eb5822d61fbbc2f3f738834ee710e996768f630527a71b9822435a3774961e18e47a3872c2f292701a4d2bf
TLSH
T11FF0AC35033BCDBE46EA345325BE8FACC273634B3485BF487588881EE5630000B907D0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC109684514F3143A384F7B96DC7872146.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ts5zk4f5\CSC109684514F3143A384F7B96DC7872146.TMP
Size 652B
SHA256 9e6b1b046b3726d3578a34238e42bf332e305c47bf7094bf5cd6f873bf61f596
MD5 8dbf3b0a7c309fc656ae3b7ec7d7fe6a
SHA1 cdab393737339442b6a86d9a5987e9c3395e18f8
SHA512 90a2dd638048273b3bc8c23f87d7c997e47e182e2aaf0cc4fcf4eba2c9dab90cb902b42e3873697e840373dcd7f0fde2a7180be76fd555cb718474086ac5be94
TLSH
T15AF05E0A63F8020EF0F35B30BEF643A7D1A8BC64DE32A3ED1441035D28656148972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ts5zk4f5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ts5zk4f5\ts5zk4f5.0.cs
Size 644B
SHA256 3485b86185a9ef0768f4f210890548aae090a3c5e904d988f3e374d0f724ab71
MD5 a2be22cb7506f42ec6828cf2f1aa24bc
SHA1 ba0b9626ae89bfbdd366aa5516769043c4e5a24f
SHA512 c914902d267e6a439e8be5b246c70f0db10c4b7e3024f9f9dcf73c700038d36c63ee550aacb37eca838df870807b3fb94229fe1425eae9f7ebd1b9d28f7e508c
TLSH
T1B6F0F69C62BB18B48027675D879752893233A4EB8A0B5F15789C0FD2DF05952B358BA1
MD5 SHA1 SHA512 TLSH

Submit Download

ts5zk4f5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ts5zk4f5\ts5zk4f5.cmdline
Size 494B
SHA256 a2af8c997672dcf4ca8fdcbe2f80339a5eac95124e7c22fc63a27a2de65fb125
MD5 c7b69cde5d3865d197609d86fc06dd78
SHA1 945a6aa6210eb137031a80af27bb53bd0c13cf6b
SHA512 6a1d8ba9d132d2118f303ac47fd5c6b288b912827f5abaa2d9ee348fb7649fe8882d11036b0787740feac3f1e9e6f6e9c5724146c2d9dc8bed436bee2ac95602
TLSH
T1F8F0973A826BC2BE41FA340719AFCABCC37303A73D416F446584881EE4370001BD17A1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2781169771D34BD2BD93F9667F6F65C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wjy04ro2\CSC2781169771D34BD2BD93F9667F6F65C.TMP
Size 652B
SHA256 a1e7c3be73fedd43287e7297a2d2d584a56bf0bd30f0a128d90e73978a2dc41d
MD5 0102e51790b23fff944767104ceea15a
SHA1 cf9a9558dae3abfb2f31862aaf2bc4de625f1a41
SHA512 aa311e8f58182f5aa260bf0c4755428570162fe46f2c03b6eb8288171f39e9aa457288d70c63fcf7ae1f35d7ff187415c9fbc06389ea6325561f094668de4b21
TLSH
T134F05E0AA3F8020EF0F34B30BDF6436791A9BC64DE7293ED14910319686461099A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wjy04ro2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wjy04ro2\wjy04ro2.0.cs
Size 262B
SHA256 6b3e4ffef08d9994cdac4cb8a80fd3775a5c66da584a676f0d829f25e5db3d1a
MD5 7173d050fc18659a8252b93ee6b93089
SHA1 6ad730d96151d389c1e45a8f564164038bd42d17
SHA512 a10a6dc9df7883304b53b183422989e3a3eac5e72c1939fd20866714a675e14d124f4c5dac49e886a3dc4ade6053552362c420f25c4b5e79a335521121c628b9
TLSH
T1D1D02B157EA2BA7000120C164C42E1FCB21B5134337B291052A50311DF1F00D4234A15
MD5 SHA1 SHA512 TLSH

Submit Download

wjy04ro2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wjy04ro2\wjy04ro2.cmdline
Size 369B
SHA256 2e32db7e77857b2eaf0d5d27d8599beed5b9d793c7e93efe0e01087d257c3d7b
MD5 276504097ac04daf32c97c391767d47c
SHA1 09291c7d708584046afd804296574b89eb9b1552
SHA512 c816a76cb4c424f1ab158b210fc3202946f594c6ddad634f34606232f6edffc55f6451343871e5423d2d376a85c7d56d9f783a48a8c7325ab1db424317156859
TLSH
T1BEE0C02A6346C27D23DD200F2779C4ECC2B3874329A9BF8C54504C1EF097002A7E1F51
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1520-549-0x000001BDBACA0000-0x000001BDBACA8000-memory.dmp

Download

memory/1520-509-0x000001BDBAC50000-0x000001BDBAC58000-memory.dmp

Download

memory/1520-517-0x000001BDBAC60000-0x000001BDBAC68000-memory.dmp

Download

memory/1520-525-0x000001BDBAC70000-0x000001BDBAC78000-memory.dmp

Download

memory/1520-533-0x000001BDBAC80000-0x000001BDBAC88000-memory.dmp

Download

memory/1520-541-0x000001BDBAC90000-0x000001BDBAC98000-memory.dmp

Download

memory/1520-501-0x000001BDBAC40000-0x000001BDBAC48000-memory.dmp

Download

memory/1520-557-0x000001BDBACB0000-0x000001BDBACB8000-memory.dmp

Download

memory/1520-493-0x000001BDBAC30000-0x000001BDBAC38000-memory.dmp

Download

memory/1840-402-0x000001E61A9D0000-0x000001E61AA18000-memory.dmp

Download

memory/4512-632-0x000001B7E9850000-0x000001B7E9858000-memory.dmp

Download

memory/4512-584-0x000001B7E9210000-0x000001B7E9218000-memory.dmp

Download

memory/4512-640-0x000001B7E9860000-0x000001B7E9868000-memory.dmp

Download

memory/4512-576-0x000001B7E9200000-0x000001B7E9208000-memory.dmp

Download

memory/4512-624-0x000001B7E9840000-0x000001B7E9848000-memory.dmp

Download

memory/4512-616-0x000001B7E9830000-0x000001B7E9838000-memory.dmp

Download

memory/4512-608-0x000001B7E9510000-0x000001B7E9518000-memory.dmp

Download

memory/4512-600-0x000001B7E9500000-0x000001B7E9508000-memory.dmp

Download

memory/4512-592-0x000001B7E9220000-0x000001B7E9228000-memory.dmp

Download

memory/4512-648-0x000001B7E9B00000-0x000001B7E9B08000-memory.dmp

Download

memory/4576-700-0x0000028C68440000-0x0000028C68448000-memory.dmp

Download

memory/4576-668-0x0000028C68030000-0x0000028C68038000-memory.dmp

Download

memory/4576-676-0x0000028C68410000-0x0000028C68418000-memory.dmp

Download

memory/4576-740-0x0000028C687C0000-0x0000028C687C8000-memory.dmp

Download

memory/4576-732-0x0000028C68480000-0x0000028C68488000-memory.dmp

Download

memory/4576-724-0x0000028C68470000-0x0000028C68478000-memory.dmp

Download

memory/4576-684-0x0000028C68420000-0x0000028C68428000-memory.dmp

Download

memory/4576-716-0x0000028C68460000-0x0000028C68468000-memory.dmp

Download

memory/4576-692-0x0000028C68430000-0x0000028C68438000-memory.dmp

Download

memory/4576-708-0x0000028C68450000-0x0000028C68458000-memory.dmp

Download

memory/4864-269-0x0000000002A10000-0x0000000002A18000-memory.dmp

Download

memory/4864-388-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-389-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-390-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-393-0x000000001C5F0000-0x000000001C61A000-memory.dmp

Download

memory/4864-394-0x000000001C5F0000-0x000000001C614000-memory.dmp

Download

memory/4864-220-0x00000000006E0000-0x0000000000704000-memory.dmp

Download

memory/4864-219-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp

Download

memory/4864-387-0x000000001CAD0000-0x000000001CAD8000-memory.dmp

Download

memory/4864-379-0x0000000021000000-0x0000000021528000-memory.dmp

Download

memory/4864-378-0x0000000020900000-0x0000000020AC2000-memory.dmp

Download

memory/4864-377-0x000000001D010000-0x000000001D01A000-memory.dmp

Download

memory/4864-376-0x000000001CFE0000-0x000000001CFE6000-memory.dmp

Download

memory/4864-375-0x000000001CFD0000-0x000000001CFD8000-memory.dmp

Download

memory/4864-374-0x000000001CFF0000-0x000000001D00C000-memory.dmp

Download

memory/4864-373-0x000000001CFA0000-0x000000001CFAA000-memory.dmp

Download

memory/4864-372-0x000000001CFB0000-0x000000001CFCE000-memory.dmp

Download

memory/4864-371-0x000000001CB60000-0x000000001CB6A000-memory.dmp

Download

memory/4864-370-0x000000001CED0000-0x000000001CF82000-memory.dmp

Download

memory/4864-369-0x000000001CEB0000-0x000000001CECE000-memory.dmp

Download

memory/4864-223-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-225-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-364-0x000000001CAC0000-0x000000001CAC8000-memory.dmp

Download

memory/4864-363-0x000000001CAB0000-0x000000001CABA000-memory.dmp

Download

memory/4864-224-0x0000000002950000-0x0000000002972000-memory.dmp

Download

memory/4864-226-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-228-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-232-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-235-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-243-0x00000000029E0000-0x00000000029E8000-memory.dmp

Download

memory/4864-256-0x0000000002A00000-0x0000000002A08000-memory.dmp

Download

memory/4864-348-0x000000001B410000-0x000000001B418000-memory.dmp

Download

memory/4864-335-0x00000000029B0000-0x00000000029B8000-memory.dmp

Download

memory/4864-283-0x0000000002A20000-0x0000000002A28000-memory.dmp

Download

memory/4864-322-0x00000000029A0000-0x00000000029A8000-memory.dmp

Download

memory/4864-275-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4864-309-0x0000000002990000-0x0000000002998000-memory.dmp

Download

memory/4864-296-0x0000000002980000-0x0000000002988000-memory.dmp

Download